{"id":"CVE-2026-106700","published":"2026-10-15T20:17:06.297","lastModified":"2026-10-16T19:56:15.773","description":"ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs no role-level or ownership validation in UserServiceImpl.resetPwd. Any authenticated user of any role can reset the password of arbitrary users, including the built-in administrator.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/elunez/eladmin","tags":[]},{"url":"https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106700.md","tags":[]},{"url":"https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106700.md","tags":[]}],"exploitRefs":[{"url":"https://github.com/elunez/eladmin","tags":[]},{"url":"https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106700.md","tags":[]},{"url":"https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106700.md","tags":[]}],"hasPoc":true,"ai":{"summary":"The ELADMIN application has a critical access control flaw that allows any authenticated user to reset passwords for any other user, including administrators. This vulnerability stems from missing authorization checks in the user management endpoint.","exploitability":"Exploitation is straightforward requiring only authentication and knowledge of target user IDs; no additional preconditions are needed beyond basic access to the application.","blast_radius":"An attacker could gain full administrative control by resetting administrator passwords, potentially compromising the entire system with minimal effort.","remediation":"Apply the vendor patch for ELADMIN v2.7.1 or later which includes proper authorization checks in the user management endpoints.","detection":"Monitor for unusual password reset requests in application logs, particularly when non-administrative users perform reset operations on administrative accounts, and watch for failed login attempts following successful password resets.","tags":["access-control","privilege-escalation","authentication"],"model":"garnet-coder","analyzedAt":"2026-10-18T15:55:52.399Z"}}