Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111604eladmin through 2.7 Broken Access Control via /api/users Update and Delete

Low 3.8

In plain English

A low-severity authorization bypass via user-controlled key in eladmin from elunez. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)3.8Low

Exploit odds (30 days)0.4%top 65.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target user ids to disable, reassign, alter, or delete accounts in other departments.

Affected products (as reported)

Vendor	Product	Versions
elunez	eladmin	0 – through 2.7

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

References

https://hackmd.io/@hieuPenguinnn/eladmin-user-update-delete-missing-dept-data-scope third-party-advisory
https://github.com/elunez/eladmin/blob/v2.7/eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java#L118-L152 technical-description
https://github.com/elunez/eladmin product
VulnCheck Advisory: eladmin through 2.7 Broken Access Control via /api/users Update and Delete third-party-advisory