CVE-2026-111604 in eladmin
Riassunto
di MITRE • 16/10/2026
eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target user ids to disable, reassign, alter, or delete accounts in other departments.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.