CVE-2026-106700 Details
Description
ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs no role-level or ownership validation in UserServiceImpl.resetPwd. Any authenticated user of any role can reset the password of arbitrary users, including the built-in administrator.
A vulnerability allowing improper access control has been identified in ELADMIN versions through 2.7. This issue resides in the user management password reset endpoint, specifically the PUT /api/users/resetPwd method of the UserController. The vulnerability arises because this method fails to implement the necessary authorization checks that are applied to other user management endpoints. Additionally, it does not validate roles or ownership in the UserServiceImpl.resetPwd method. As a result, any authenticated user, regardless of their role, can reset the passwords of any users, including the built-in administrator.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106700.md | CISA-ADP | Technical Description |
| https://github.com/elunez/eladmin | [email protected] | ProductSource CodeVendor |
| https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106700.md | [email protected] | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| ELADMIN | <= 2.7 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |