Software component issue could allow unauthorized access
ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing…
What happened
- ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither validates the granted menu set nor prevents a caller from modifying its own role. A logged-in non-admin user whose role holds the delegated roles:edit permission can submit its own role id together with an arbitrary list of menu ids.Security Advisory CVE-2026-106705
- ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level.Advisory description (CVE-2026-106705)
Contributing factors stated by the source
- ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level.
The failure pattern
Watch the pattern: Cross-tenant access through a caller-controlled identifier
Related standards
CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.
Building something similar?
Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.
Incidents with the same pattern
Non-secret app ID lets anyone register for private apps built on the Base44 AI app builder (2025)
By supplying only an application's non-secret appid to undocumented registration and email-verification endpoints, an attacker could create a verified account on private applications built with Base44.
Default password and an IDOR in McDonald's AI hiring chatbot platform expose data on 64 million applicants (2025)
McHire, the chatbot recruiting platform used by most McDonald's franchisees, lets applicants chat with a bot named Olivia, built by Paradox.ai, that collects personal information.
Privilege escalation and a certificate-validation flaw allow cross-account database access (Azure PostgreSQL "ExtraReplica", 2022)
Researchers exploited a bug in Azure's modified PostgreSQL engine to gain superuser privileges and run operating-system commands on their own database instance.
Missing access checks in a document portal expose over 800 million First American images (2019)
Sequential integer URLs in imaging web portal lacked object-level authorization checks; exposed 885 million escrow and wire documents.
Software component issue could allow unauthorized access
The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is…
Software component issue could expose accounts or credentials
A missing authorization vulnerability exists in the internal API /api/v1/secrets/ of some of Moxa's industrial computing products.