{"id":"CVE-2026-106705","kind":"vulnerability","aliases":["CVE-2026-106705"],"related":[],"title":"ELADMIN: role menu endpoint lets a user grant itself extra menus","description":"ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither validates the granted menu set nor prevents a caller from modifying its own role. A logged-in non-admin user whose role holds the delegated `roles:edit` permission can submit its own role id together with an arbitrary list of menu ids.","summary":"ELADMIN (eladmin-mp) up to 2.7: PUT /api/roles/menu (RoleController.updateRoleMenu) only compares the target role's level with the caller's minimum level. It does not validate the submitted menu set or block edits to the caller's own role. A logged-in non-admin whose role has roles:edit can send its own role id with any menu ids and replace its role-menu mappings. Permission caches are cleared, so the expanded permissions apply to the next request. CVSS 3.1 8.8. The discoverer's writeup shows the request shape but no exploit code. No fixed version is published.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"eladmin-mp","fixed":[],"affected":"<= 2.7","ecosystem":"maven"}],"ecosystems":[],"tags":["eladmin","eladmin-mp","java","package","privilege-escalation","self-hosted"],"not_affected_if":["auth-required","default-config","no-delegated-roles-edit"],"how_to_check":"Check whether your build is eladmin-mp 2.7 or earlier (the pom version or your git checkout of elunez/eladmin-mp). Then see whether RoleController.updateRoleMenu still only calls getLevels(...). List which roles hold the roles:edit permission (the sys_menu permission column and the role-menu mapping). Any non-admin role that holds it can escalate. Audit sys_roles_menus for unexpected menu grants on those roles.","fix":"No patched release is known: eladmin-mp has no GitHub releases and I found no fix commit for updateRoleMenu. Interim: remove roles:edit from every non-admin role. Or patch updateRoleMenu to reject requests whose role id is one of the caller's own roles, and to check that the submitted menus are a subset of the caller's own menus. Watch elunez/eladmin-mp for a fix.","status":"open","published_at":"2026-10-16T15:17:04+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:34:46+00:00","updated_at":"2026-10-24T00:26:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:34:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ELADMIN: role menu endpoint lets a user grant itself extra menus","impact":"high","summary":"ELADMIN (eladmin-mp) up to version 2.7 has an access control flaw in its role management API. A logged-in user with the roles:edit permission can edit their own role and grant itself any menu set, gaining admin functions.","category":"package","who_cares":["eladmin","eladmin-mp","self-hosted","java"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated user escalates to admin menus and functions","analyst_note":"Find the patched version and the fixed RoleController.updateRoleMenu via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-106705 and the project repository.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required","default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000479,"input_tokens":2987,"output_tokens":360,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the patched version and the fixed RoleController.updateRoleMenu via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-106705 and the project repository.","search":"'-106705':14A,17A '-2026':13A,16A '/api/roles/menu':41B,156C '2.7':39B,141C '3.1':116B '8.8':117B 'access':145C 'admin':79B,198C 'appli':110B 'applic':176C 'arbitrari':217C 'author':158C 'block':65B 'cach':103B 'caller':52B,69B,171C,186C 'clear':105B 'code':129B 'compar':44B,163C 'contain':142C 'control':146C 'cve':12A,15A 'cvss':115B 'deleg':204C 'discover':119B 'edit':66B,84B,206C 'eladmin':1A,19A,21B,23B,33B,35B,135C,137C 'eladmin-mp':18A,22B,34B,136C 'endpoint':4A,154C 'escal':29B 'expand':108B 'exploit':128B 'extra':10A 'fix':131B 'grant':8A,180C 'hold':202C 'host':32B 'id':90B,94B,213C,221C 'improp':144C 'java':25B 'let':5A 'level':49B,55B,168C,174C 'list':218C 'log':75B,194C 'logged-in':74B,193C 'manag':151C 'map':101B 'menu':3A,62B,93B,100B,181C,220C 'menus':11A 'minimum':54B,173C 'modifi':188C 'modul':152C 'mp':20A,24B,36B,138C 'neither':177C 'next':113B 'non':78B,197C 'non-admin':77B,196C 'packag':26B 'permiss':102B,109B,207C 'prevent':184C 'privileg':28B 'privilege-escal':27B 'publish':134B 'put':40B,155C 'replac':96B 'request':114B,124B,160C 'role':2A,47B,72B,81B,83B,89B,99B,150C,166C,191C,201C,205C,212C 'role-menu':98B 'rolecontroller.updaterolemenu':42B,157C 'self':31B 'self-host':30B 'send':86B 'set':63B,182C 'shape':125B 'show':122B 'submit':61B,209C 'target':46B,165C 'togeth':214C 'user':7A,199C 'valid':59B,178C 'version':132B 'vulner':147C 'whose':80B,200C 'writeup':121B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T15:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-106705","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106705","severity":null,"published_at":"2026-10-16T15:17:04+00:00","modified_at":"2026-10-16T19:56:15+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-106705:663","url":null,"severity":null,"published_at":"2026-10-24T00:26:52+00:00","modified_at":"2026-10-24T00:26:52+00:00","first_seen_at":"2026-10-24T00:26:52+00:00","fetched_at":"2026-10-24T00:26:52+00:00","note":"Read CVE record and discoverer writeup (xutao). No fixed version or fix commit found for eladmin-mp: repo has no releases; commit 55fbf70 in elunez/eladmin (JPA edition) fixes PUT /api/roles and isAdmin, not /api/roles/menu, so I did not link it as the fix. No exploitation seen (not in KEV, EPSS ~0.25%). Social search skipped: low-profile Chinese admin project."}],"documents":[{"id":2615,"url":"https://www.cve.org/CVERecord?id=CVE-2026-106705","title":"CVE Record: CVE-2026-106705","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2611,"url":"https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106705.md","title":"CVE-2026-106705 writeup by xutao (request shape, no code)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":2612,"url":"https://github.com/elunez/eladmin-mp","title":"elunez/eladmin-mp repository (no releases published)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}