CVE-2026-111604 eladmin through 2.7 Broken Access Control via /api/users Update and Delete
User managers can modify or delete accounts outside their department due to missing authorization checks in user update and delete handlers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111604?
CVE-2026-111604 is a medium-severity missing authorization vulnerability in elunez eladmin, published on 16 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target user ids to disable, reassign, alter, or delete accounts in other departments.
Weakness: CWE-639
Which versions are affected by CVE-2026-111604?
How do I fix CVE-2026-111604?
No fix has been published for CVE-2026-111604 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-111604 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111604 exists.
Sources
Also known as GHSA-7qp5-57jr-xmpr.