CVE-2026-106705
8.8HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-284
Impact
Authenticated low-privileged users with the roles:edit permission can grant themselves full administrator menu access. An attacker needs valid credentials for an account that has role editing permissions.
Root cause
The PUT /api/roles/menu endpoint only checks role hierarchy levels without verifying granted menus or preventing callers from updating their own roles.
Affected systems
ELADMIN (eladmin-mp) up to 2.7
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
No fixed version is specified; revoke the roles:edit permission from non-admin accounts or block requests to PUT /api/roles/menu at the reverse proxy until custom application patches are deployed.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither validates the granted menu set nor prevents a caller from modifying its own role. A logged-in non-admin user whose role holds the delegated `roles:edit` permission can submit its own role id together with an arbitrary list of menu ids.