| Title | eladmin 2.7 Improper Access Controls |
|---|
| Description | The PUT /api/roles endpoint in eladmin v2.7 contains a critical authorization bypass vulnerability where attackers caneither demote high-privileged admin roles or escalate data access permissions by exploiting insufficient validationin the getLevels() method, which only checks if the submitted level value is greater than or equal to the user'scurrent level without verifying the target role's original permissions, allowing lower-privileged users (e.g.,level=3) to modify higher-privileged roles (e.g., level=1) by submitting a request with a level matching their own,while completely omitting the level field bypasses all checks and lets attackers arbitrarily modify the dataScopefield to "全部" (all data access) or other values, effectively enabling privilege escalation, unauthorized roledemotion, and global data access through direct manipulation of these unprotected parameters. |
|---|
| Source | ⚠️ https://github.com/elunez/eladmin/issues/898 |
|---|
| User | AliceS614 (UID 94277) |
|---|
| Submission | 04/24/2026 16:24 (3 months ago) |
|---|
| Moderation | 05/23/2026 08:31 (29 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 361917 [eladmin up to 2.7 Users API Endpoint UserController.java checkLevel access control] |
|---|
| Points | 0 |
|---|