Live › vulnerability › CVE-2026-111604
Go to dashboardeladmin through 2.7 has write handlers that skip department checks on user records. A user with user:edit or user:del permission can send PUT or DELETE requests to /api/users to change or remove accounts in other departments.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running eladmin 2.7 or earlier with department-scoped user management roles, where some users hold user:edit or user:del permissions. Installations that do not use department scoping or do not grant those permissions are less exposed. The sources do not name a patched version.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target user ids to disable, reassign, alter, or delete accounts in other departments.
This page as .md · .json · in your agent: get_signal("CVE-2026-111604")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.