CVE-2026-106700: High severity eladmin eladmin vulnerability
ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs no role-level or ownership validation in UserServiceImpl.resetPwd. Any authenticated user of any role can reset the password of arbitrary users, including the built-in administrator.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated ELADMIN user can exploit it, regardless of assigned role. The affected endpoint allows that user to target arbitrary accounts, including the built-in administrator.
What access does an attacker need?
The attacker needs network access to the ELADMIN instance and valid credentials for any authenticated account. No victim interaction is required.
Are administrator accounts affected?
Yes. The password-reset operation can be used against arbitrary users, explicitly including the built-in administrator account.
How can I determine whether my deployment is affected?
Deployments running ELADMIN v2.7 or earlier are affected according to the available information. Review whether authenticated users can reach PUT /api/users/resetPwd and whether the application version falls within that range.