Missing authorization in ELADMIN lets any user reset passwords
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
ELADMIN v2.7 and earlier lacks the authorization check on the PUT /api/users/resetPwd endpoint, which is CWE-862 (Missing Authorization). Any authenticated user, whatever their role, can reset the password of other users, including the built-in administrator. An attacker needs only an ordinary account with low privileges and no user interaction, and the flaw can fully compromise confidentiality, integrity and availability.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs no role-level or ownership validation in UserServiceImpl.resetPwd. Any authenticated user of any role can reset the password of arbitrary users, including the built-in administrator.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for ELADMIN.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-106700
- 2026-10-16 Priority changed: MEDIUM → LOW
- 2026-10-16 Weakness changed · CISA ADP
- 2026-10-16 CISA SSVC decision points changed
- 2026-10-16 Priority changed: LOW → MEDIUM
- 2026-10-18 Alias added: GHSA-qq2j-vwx6-5h5f
References
Sources
- CVE-2026-106700 · CVE Program
- CVE-2026-106700 · NVD
- FIRST EPSS
- GHSA-qq2j-vwx6-5h5f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences