CVE-2026-108706: Missing Authorization in elunez eladmin
Description
CVE-2026-108706 is a missing authorization vulnerability in elunez eladmin affecting the downloadS3Storage handler. Authenticated users without proper storage permissions can enumerate sequential IDs via the GET /api/s3Storage/download/{id} endpoint to retrieve URLs of stored objects. This exposure allows unauthorized access to file contents stored in publicly readable buckets. The vulnerability has a medium severity with a CVSS score of 5.3. A patch is available, and the product is a cloud service, so vendor-managed remediation is expected.
CVSS v4.0
Score 5.3medium
Affected software
elunez
eladmin
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
elunez eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler. This flaw allows any authenticated user to bypass storage permissions and retrieve stored object URLs by enumerating sequential IDs via the GET /api/s3Storage/download/{id} endpoint. As a result, attackers can collect URLs of all uploaded objects, exposing file contents stored in publicly readable buckets. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity). The affected version is 0. The product is cloud-hosted, and a patch is available.
Potential Impact
Unauthorized authenticated users can access URLs of stored objects without having storage permissions, potentially exposing sensitive file contents stored in publicly readable buckets. This could lead to information disclosure but does not allow privilege escalation or code execution based on the provided data.
Mitigation Recommendations
A patch is available for this vulnerability. Since eladmin is a cloud-hosted service, the vendor manages remediation server-side. Users should verify with the vendor advisory that the patch has been applied to their environment to prevent unauthorized access to stored object URLs.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-10T23:50:44.748Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Is Cloud Service
- true
Threat ID: 6acaeb262cdf04f656a49dc7
Added to database: 10/11/2026, 01:49:26 UTC
Last enriched: 10/11/2026, 02:03:29 UTC
Last updated: 10/11/2026, 02:04:02 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.