Threats tagged 'ghsa-7qp5-57jr-xmpr'

eladmin versions up to 2.7 have an authorization bypass vulnerability allowing department-scoped user managers with user:edit or user:del permissions to modify or delete user accounts outside their authorized department scope. This occurs because write handlers do not enforce department checks when processing PUT or DELETE requests to /api/users. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1.