CVE-2026-111604

CVE-2026-111604 is a low-severity vulnerability rated 3.8/10 on the CVSS scale. eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target user ids to disable, reassign, alter, or delete accounts in other departments.. EPSS estimates a 0.33% chance of exploitation in the next 30 days.