CVE-2026-111604 Details

A broken access control vulnerability has been identified in eladmin versions through 2.7. This issue allows department-scoped user managers to modify or delete user accounts in other departments, bypassing data scope restrictions. The vulnerability arises because the update and delete handlers in the UserController do not enforce department checks, unlike the query handler, which properly restricts access based on departmental data scope. As a result, an authenticated user with 'user:edit' or 'user:del' permissions can send requests to the '/api/users' endpoint to alter or remove accounts outside their assigned department.

The vulnerability can be addressed by adding department scope checks to the update and delete handlers in the UserController, ensuring that users can only modify or delete accounts within their own department.