ELADMIN eladmin-mp: Improper access control in role menu management
Summary
ELADMIN (eladmin-mp) up to version 2.7 contains an improper access control flaw in its role management module. The endpoint PUT /api/roles/menu checks only the target role's level and does not validate the submitted menu set or prevent a user from changing their own role. An authenticated non-admin user whose role holds the roles:edit permission can therefore grant their own role arbitrary menus and escalate privileges.
Affected
- ELADMIN (eladmin-mp) up to and including 2.7
- Affected component: RoleController.updateRoleMenu (PUT /api/roles/menu)
Fixed in
Unknown.
Workaround
- No vendor workaround known.
- Remove roles:edit from all non-administrator roles where it is not strictly required (own recommendation, not a vendor statement).
- Restrict access to the admin interface and API, for example by VPN, IP allow-listing or a reverse-proxy rule.
Exploitation
- Requires a valid account whose role includes roles:edit.
- No known exploitation in the wild; not listed in CISA KEV.
- No public exploit confirmed in the sources.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Identify any ELADMIN installation, its version and whether it is reachable from the internet.
- Review which roles hold roles:edit and check current role-menu assignments for unexpected menus.
- Restrict the admin interface to internal networks and enforce MFA on admin accounts.
- Do not consider the issue fixed until a patched version is confirmed by the upstream repository.
- Also review related ELADMIN CVEs from the same period, such as CVE-2026-106700 (password reset).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-106705 write-up (tao0845/CVE-Request) github.com
- ELADMIN eladmin-mp repository github.com
- OpenCVE CVE-2026-106705 app.opencve.io
- VulDB 421307 vuldb.com
- Vulners VulnRichment CVE-2026-106705 vulners.com
- SecurityFocus CVE-2026-106705 www.securityfocus.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:03.
Original description (NVD)
ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither validates the granted menu set nor prevents a caller from modifying its own role. A logged-in non-admin user whose role holds the delegated `roles:edit` permission can submit its own role id together with an arbitrary list of menu ids.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.