Authorization Bypass in eladmin User Management

Executive Summary

This vulnerability is an authorization bypass in eladmin through version 2.7. Department-scoped user managers can modify or delete accounts outside their assigned data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target user IDs to disable, reassign, alter, or delete accounts in other departments.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect HTTP requests to /api/users endpoints for PUT or DELETE methods with user IDs outside the expected department scope. Check if department-based access controls are enforced in write operations but not in read operations. Review UserController.java for inconsistent @PreAuthorize annotations between GET and PUT/DELETE methods.

Useful 0 Not Useful 0

Impact Analysis

An attacker with delegated user management permissions in one department could disable, reassign, or delete user accounts in other departments. This allows unauthorized users to cross organizational boundaries, potentially disrupting operations or causing data loss. The impact is limited to users whose role levels are not higher than the attacker's minimum role level.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update eladmin to a patched version beyond 2.7. If unavailable, restrict PUT/DELETE access to /api/users via network policies or application-level controls. Implement strict role-based checks in UserController.java to enforce department scope for all write operations. Monitor logs for unauthorized PUT/DELETE requests to /api/users.

Useful 0 Not Useful 0