ELADMIN: Improper access control in user password reset endpoint

Summary

ELADMIN v2.7 and earlier contains an improper access control flaw in the user-management endpoint PUT /api/users/resetPwd. The endpoint lacks the authorization check applied to other user-management endpoints and performs no role or ownership validation. Any authenticated user, regardless of role, can reset the password of arbitrary accounts, including the built-in administrator, which can lead to account takeover and privilege escalation.

Affected

• ELADMIN v2.7 and earlier (version range from aggregator data; the CVE record lists no product or version)

Fixed in

Unknown.

Workaround

• Restrict access to /api/users/resetPwd (and the wider /api/users path) to administrators only, for example with firewall rules or application-level role checks.
• Take the ELADMIN panel off the internet if it is not required there.

Exploitation

• Public technical details are known, according to VulDB; no exploit is reported as available.
• No exploitation in the wild has been reported. CISA SSVC lists exploitation as none and automatable as no.
• The CVE is not listed in CISA KEV.

Our recommendation

• Inventory all ELADMIN instances and confirm their versions.
• Treat every instance at version 2.7 or earlier as vulnerable, as no vendor fix has been confirmed.
• Apply the access restrictions above now and limit who can reach the admin panel.
• Review logs for resetPwd calls by non-admin accounts.
• If any suspicious reset is found, change the administrator passwords and invalidate active sessions.
• Monitor the upstream elunez/eladmin repository for a fixed release and confirm it before relying on it.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• ELADMIN GitHub repository github.com
• CVE-Request write-up CVE-2026-106700 github.com
• OpenCVE CVE-2026-106700 app.opencve.io
• VulDB 420859 vuldb.com
• Vulners MEND CVE-2026-106700 vulners.com
• Strix CVE-2026-106700 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:31.