CVE-2026-111604: Authorization Bypass Through User-Controlled Key in elunez eladmin

CVE-2026-111604 describes an authorization bypass in eladmin through version 2.7. The flaw allows users with user:edit or user:del permissions scoped to a specific department to perform unauthorized modifications or deletions on user accounts belonging to other departments. This is due to the write handlers skipping department scope validation when processing PUT or DELETE requests targeting user IDs. The vulnerability has a CVSS 4.0 base score of 5.1, indicating a medium severity level.

Attackers with elevated permissions limited to their department can escalate their control by modifying or deleting user accounts outside their authorized scope. This can lead to unauthorized account changes, potential denial of service for affected users, and compromise of access controls within the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user:edit and user:del permissions carefully and monitor for suspicious activity involving cross-department user modifications.