CVE-2026-111604

CVE-2026-111604 updated by NVD

Modified

2026-10-22

Sources

nvd

Summary

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target user ids to disable, reassign, alter, or delete accounts in other departments.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-111604