CVE-2026-106705
Received Received - Intake

Improper Access Control in ELADMIN Role Management Module

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: MITRE

Description
ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither validates the granted menu set nor prevents a caller from modifying its own role. A logged-in non-admin user whose role holds the delegated `roles:edit` permission can submit its own role id together with an arbitrary list of menu ids.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-106705
EUVD
EUVD-2026-102904

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an improper access control vulnerability in ELADMIN (eladmin-mp) up to version 2.7. The application fails to properly validate role and menu permissions. A non-admin user with the delegated roles:edit permission can modify their own role's menu assignments by sending a PUT request to /api/roles/menu with their role ID and arbitrary menu IDs. This allows privilege escalation without proper authorization checks.

Detection Guidance

Check for unauthorized PUT requests to /api/roles/menu with non-admin role IDs. Monitor logs for requests where a user modifies their own role's menu assignments. Use tools like curl to test endpoints: curl -X PUT http://<target>/api/roles/menu -H 'Content-Type: application/json' -d '{"roleId":<user_role_id>,"menuIds":[<arbitrary_ids>]}'

Inspect RoleController.updateRoleMenu and RoleServiceImpl.updateMenu for improper access control logic. Verify if the application validates menu sets or prevents self-role modification.

Impact Analysis

An attacker could exploit this to escalate their privileges within the system. They could grant themselves access to unauthorized menus or functions, potentially gaining control over sensitive data or administrative functions. This could lead to unauthorized data access, data manipulation, or system compromise depending on the granted permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection regulations like GDPR and HIPAA. It may result in unauthorized data exposure, modification, or deletion, which are direct violations of these standards' security and privacy controls.

Mitigation Strategies

Apply patches or updates from the eladmin-mp project if available. Restrict roles:edit permission to admin-only users. Implement server-side validation to ensure users cannot modify their own roles or unrelated menu sets.

Temporarily disable the PUT /api/roles/menu endpoint if a fix is not immediately available. Review and audit all role and menu assignments for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106705. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart