Threat database

eladmin versions up to 2.7 have an authorization bypass vulnerability allowing department-scoped user managers with user:edit or user:del permissions to modify or delete user accounts outside their authorized department scope. This occurs because write handlers do not enforce department checks when processing PUT or DELETE requests to /api/users. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1.

ELADMIN version 2.7 and earlier contains a Cross Site Scripting (XSS) vulnerability in the WebSocketServer, SpringSecurityConfig, and deploy.vue components. This vulnerability allows an attacker to execute malicious scripts in the context of the affected application. The vulnerability has a medium severity with a CVSS score of 6.1.

CVE-2026-108706 is a missing authorization vulnerability in elunez eladmin's downloadS3Storage handler. It allows any authenticated user to access stored object URLs without proper storage permissions by enumerating sequential IDs. This exposure can lead to unauthorized access to file contents stored in publicly readable buckets. The vulnerability has a medium severity with a CVSS score of 5.3. A patch is available, and the product is a cloud service, so vendor-managed remediation is expected.

Eladmin versions up to 2.7 have a missing authorization vulnerability in the LocalStorageController uploadPicture handler. This flaw allows low-privileged authenticated users to bypass the storage:add permission. Exploitation involves sending POST requests with image-named files to the /api/localStorage/pictures endpoint, enabling unauthorized file writes to the server's local storage and disclosure of absolute server paths. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity.

CVE-2026-77036 is a medium severity vulnerability in elunez eladmin up to version 2.7. It involves improper authorization in several controller functions (EmailController, AliPayController, GeneratorController, GenConfigController). The vulnerability allows remote attackers to exploit authorization weaknesses. The issue was reported early to the project, but no response or fix has been provided yet. Exploit code has been publicly disclosed, but no known active exploitation in the wild has been confirmed.

CVE-2026-10550 is a command injection vulnerability in elunez eladmin affecting versions 2.0 through 2.7. The issue arises from unsafe manipulation of the uploadPath argument in the Application Deployment Module's App.java file. This flaw allows remote attackers to execute arbitrary commands. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3. No official patch or remediation has been announced by the vendor as of the publication date.

eladmin <=2.7 is vulnerable to CSV Injection in the exception log download module.

The eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can control all application deployment servers of this management system via DeployController.java.

A Server-Side Request Forgery (SSRF) vulnerability has been identified in eladmin 2.7 and earlier in ServerDeployController.java. The manipulation of the HTTP Body ip parameter leads to SSRF.