| Title | elunez eladmin latest broken function level authorisation |
|---|
| Description | Title: Broken Function Level Authorization (BFLA) in eladmin
POC:
Unauthorized Email Update:
A user can update another user's email address without proper authorization.
The updateUserEmail in UserController takes a User object from the request body, and it's possible to change the id or username field in the request to target another user. Although it gets the current user from the security context, it doesn't use it to ensure the user being updated is the same as the authenticated user. |
|---|
| Source | ⚠️ https://www.cnblogs.com/aibot/p/19063332 |
|---|
| User | Anonymous User |
|---|
| Submission | 08/29/2025 06:05 (11 months ago) |
|---|
| Moderation | 09/05/2025 10:59 (7 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 322739 [elunez eladmin up to 2.7 Email Address /api/users/updateEmail/ updateUserEmail id/email improper authorization] |
|---|
| Points | 20 |
|---|