CVE-2025-10014: elunez eladmin Email Address updateEmail updateUserEmail improper authorization
A flaw has been found in elunez eladmin up to 2.7. This impacts the function updateUserEmail of the file /api/users/updateEmail/ of the component Email Address Handler. Executing manipulation of the argument id/email can lead to improper authorization. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is said to be difficult. The exploit has been published and may be used. It is required to know the RSA-encrypted password of the attacked user account.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10014?
CVE-2025-10014 is considered a medium severity vulnerability due to improper authorization in the email address update function.
How do I fix CVE-2025-10014?
To fix CVE-2025-10014, update elunez eladmin to version 2.8 or later where the vulnerability is resolved.
What impact does CVE-2025-10014 have on affected systems?
CVE-2025-10014 allows unauthorized users to manipulate user email addresses, potentially leading to account takeover.
Which versions of elunez eladmin are affected by CVE-2025-10014?
CVE-2025-10014 affects all versions of elunez eladmin up to and including version 2.7.
What is the exploit vector for CVE-2025-10014?
The exploit vector for CVE-2025-10014 involves manipulating the email and id arguments in the API endpoint /api/users/updateEmail/.