Description
eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target user ids to disable, reassign, alter, or delete accounts in other departments.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
elunez eladmin
Default version status: unaffected
0 to ≤ 2.7affected
pkg:github/elunez/eladminReferences
- https://hackmd.io/@hieuPenguinnn/eladmin-user-update-delete-missing-dept-data-scope ↗
- https://github.com/elunez/eladmin/blob/v2.7/eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java#L118-L152 ↗
- https://github.com/elunez/eladmin ↗
- https://www.vulncheck.com/advisories/eladmin-through-2.7-broken-access-control-via-api-users-update-and-delete ↗