This vulnerability in eladmin up to version 2.7 arises from improper access control checks in the checkLevel function within the Users API Endpoint (/rest/UserController.java). Remote attackers can exploit this flaw to manipulate access controls, potentially gaining unauthorized access or privileges. The issue was reported early to the project maintainers, but no response or remediation has been provided. The CVSS 4.0 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

The improper access control vulnerability allows remote attackers to bypass intended restrictions on user access levels, which could lead to unauthorized actions or data exposure within the eladmin application. Since the vulnerability affects a core user management API endpoint, exploitation could impact user data confidentiality or integrity depending on the application's use. No confirmed exploits are currently known in the wild.

As of the current information, no official patch or remediation is available from the vendor. Users of eladmin up to version 2.7 should monitor the vendor's advisories for updates. Until a fix is released, consider implementing additional access control checks at network or application layers to limit exposure of the vulnerable endpoint. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.