CVE-2026-111604: eladmin through 2.7 Broken Access Control via /api/users Update and Delete
eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target user ids to disable, reassign, alter, or delete accounts in other departments.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated department-scoped user manager with either the user:edit permission or the user:del permission can exploit it. The attacker must be able to send PUT or DELETE requests to /api/users and supply target user IDs.
What can an attacker do outside their assigned department?
They can modify or delete accounts that are outside their department data scope. Reported impacts include disabling, reassigning, altering, or deleting those accounts.
How can I determine whether my deployment is affected?
Deployments running eladmin through 2.7 are affected if department-scoped managers have user:edit or user:del permissions. Review PUT and DELETE requests to /api/users initiated by those accounts, especially where the target user belongs to another department.