---
id: "CVE-2026-106705"
kind: "vulnerability"
aliases: ["CVE-2026-106705"]
title: "ELADMIN: role menu endpoint lets a user grant itself extra menus"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "eladmin-mp", "fixed": [], "affected": "<= 2.7", "ecosystem": "maven"}]
ecosystems: []
tags: ["eladmin", "eladmin-mp", "java", "package", "privilege-escalation", "self-hosted"]
not_affected_if: ["auth-required", "default-config", "no-delegated-roles-edit"]
published_at: "2026-10-16T15:17:04+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-24T00:26:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106705", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:26:52+00:00"}]
---

# ELADMIN: role menu endpoint lets a user grant itself extra menus

ELADMIN (eladmin-mp) up to 2.7: PUT /api/roles/menu (RoleController.updateRoleMenu) only compares the target role's level with the caller's minimum level. It does not validate the submitted menu set or block edits to the caller's own role. A logged-in non-admin whose role has roles:edit can send its own role id with any menu ids and replace its role-menu mappings. Permission caches are cleared, so the expanded permissions apply to the next request. CVSS 3.1 8.8. The discoverer's writeup shows the request shape but no exploit code. No fixed version is published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:eladmin-mp affected <= 2.7 fixed ?

## How to check

Check whether your build is eladmin-mp 2.7 or earlier (the pom version or your git checkout of elunez/eladmin-mp). Then see whether RoleController.updateRoleMenu still only calls getLevels(...). List which roles hold the roles:edit permission (the sys_menu permission column and the role-menu mapping). Any non-admin role that holds it can escalate. Audit sys_roles_menus for unexpected menu grants on those roles.

## Fix

No patched release is known: eladmin-mp has no GitHub releases and I found no fix commit for updateRoleMenu. Interim: remove roles:edit from every non-admin role. Or patch updateRoleMenu to reject requests whose role id is one of the caller's own roles, and to check that the submitted menus are a subset of the caller's own menus. Watch elunez/eladmin-mp for a fix.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106705
- 2026-10-24T00:26:52+00:00 analyst — Read CVE record and discoverer writeup (xutao). No fixed version or fix commit found for eladmin-mp: repo has no releases; commit 55fbf70 in elunez/eladmin (JPA edition) fixes PUT /api/roles and isAdmin, not /api/roles/menu, so I did not link it as the fix. No exploitation seen (not in KEV, EPSS ~0.25%). Social search skipped: low-profile Chinese admin project.

## Documents

- [advisory] CVE Record: CVE-2026-106705 https://www.cve.org/CVERecord?id=CVE-2026-106705
- [mentions] elunez/eladmin-mp repository (no releases published) https://github.com/elunez/eladmin-mp
- [poc] CVE-2026-106705 writeup by xutao (request shape, no code) https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106705.md

## From the sources

ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither validates the granted menu set nor prevents a caller from modifying its own role. A logged-in non-admin user whose role holds the delegated `roles:edit` permission can submit its own role id together with an arbitrary list of menu ids.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_