CVE-2026-77036: Improper Authorization in elunez eladmin

This vulnerability affects elunez eladmin versions 2.0 through 2.7 and involves improper authorization in multiple controller functions, including EmailController, AliPayController, GeneratorController, and GenConfigController. The flaw allows remote attackers to bypass authorization controls, potentially enabling unauthorized actions. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. The project was notified early but has not issued a fix or response. Public exploit code is available, though no active exploitation is known.

The vulnerability allows remote attackers to perform unauthorized actions by exploiting improper authorization in key controller functions. This could lead to unauthorized access or manipulation of functionality related to email, payment processing (AliPay), code generation, and configuration management within eladmin. The impact is rated medium based on CVSS 5.3, reflecting limited but meaningful risk due to the nature of the affected components and the ease of remote exploitation without user interaction or privileges.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor's advisories for updates. In the meantime, consider restricting access to the affected controller endpoints through network controls or application-level access restrictions to reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.