Live › vulnerability › CVE-2026-106705
Go to dashboardELADMIN (eladmin-mp) up to 2.7: PUT /api/roles/menu (RoleController.updateRoleMenu) only compares the target role's level with the caller's minimum level. It does not validate the submitted menu set or block edits to the caller's own role. A logged-in non-admin whose role has roles:edit can send its own role id with any menu ids and replace its role-menu mappings. Permission caches are cleared, so the expanded permissions apply to the next request. CVSS 3.1 8.8. The discoverer's writeup shows the request shape but no exploit code. No fixed version is published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| eladmin-mp | maven | <= 2.7 | – |
s own roles, and to check that the submitted menus are a subset of the callers own menusEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither validates the granted menu set nor prevents a caller from modifying its own role. A logged-in non-admin user whose role holds the delegated roles:edit permission can submit its own role id together with an arbitrary list of menu ids.
This page as .md · .json · in your agent: get_signal("CVE-2026-106705")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.