EUVD-2026-102421Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as any low-privilege user
-
ExploitCall PUT /api/users/resetPwd for admin ID
-
ExecutionReset administrator password with no authz check
-
ImpactLog in as admin and take over system
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session of ANY role on the target ELADMIN instance (CVSS PR:L); no admin rights, user interaction, or special configuration are needed. The exact precondition is access to the PUT /api/users/resetPwd endpoint, which lacks the method-level authorization annotation applied to all other user-management endpoints and performs no role or ownership validation in UserServiceImpl.resetPwd. Limiting factors: affected versions are ELADMIN v2.7 and earlier, and realistic risk rises sharply where the deployment is internet-facing or permits low-trust/self-service account creation; instances restricted to a small set of trusted operators are materially lower risk. |
| Impact | This is a genuine, high-priority broken-access-control flaw rather than an inflated high-CVSS score. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) is internally consistent with the description: a network-reachable web endpoint, trivial to trigger, requiring only a low-privilege authenticated session, with full compromise of the targeted account. The one mitigating signal is PR:L - exploitation requires an existing account of any role, so this is not fully unauthenticated. No EPSS score, no CISA KEV listing, and no confirmed public exploit code were supplied; the only non-vendor reference is a CVE-request writeup, not weaponized PoC. There are no conflicting signals in the CVSS data, but the absence of exploitation-probability (EPSS) and SSVC data means real-world weaponization likelihood cannot be quantified from the input. Net: treat as a serious privilege-escalation/account-takeover bug on any ELADMIN-based deployment where untrusted or low-trust users can obtain accounts, but note active exploitation is not evidenced. |
| Exploit ScenarioDerived | A low-privilege authenticated ELADMIN user (or a self-registered account, where registration is enabled) sends a crafted PUT request to /api/users/resetPwd targeting the built-in administrator's user ID. Because the endpoint omits the method-level authorization check present on sibling endpoints, the password is reset with no role or ownership validation, and the attacker logs in as administrator for full system takeover. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Password reset authorization bypass in ELADMIN v2.7 and earlier allows any authenticated user, regardless of role, to reset arbitrary account passwords-including the built-in administrator-by sending PUT /api/users/resetPwd. The endpoint lacks the method-level authorization check applied to other user-management endpoints and performs no role or ownership validation in UserServiceImpl.resetPwd, so a low-privileged session can take over privileged accounts. No public exploit was identified at time of analysis, but the CVSS 3.1 score is 8.8 (PR:L) and the flaw is a genuine high-priority broken-access-control issue; risk is highest for internet-facing instances or those allowing self-service account creation.
RemediationAI
No vendor-released patch identified at time of analysis; there is no exact fixed version in the supplied data, so do not assume an upgrade target beyond checking the project repository for an updated release. Primary remediation is to add and enforce the missing authorization check on PUT /api/users/resetPwd-require an administrator role and, where applicable, ownership or target-user validation in UserServiceImpl.resetPwd; if the codebase is deployed in-house, backport or implement this method-level access control immediately. Compensating controls: block or restrict network access to /api/users/resetPwd at the reverse proxy/WAF to trusted admin management networks (side effect: legitimate remote password-reset workflows from other networks stop working); disable or remove the endpoint if password reset is not operationally required (side effect: loss of self-service reset functionality); disable self-registration and tightly limit authenticated accounts because the flaw is exploitable by ANY role (side effect: onboarding friction); monitor and alert on password-reset events, especially those changing administrator credentials, and rotate administrator passwords if compromise is suspected. Consult https://github.com/elunez/eladmin and https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106700.md for project/CVE context.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The supplied CPE value cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:* is a placeholder and does not identify a concrete vendor/product/version, so exact CPE-based enumeration is not possible from the feed; the authoritative affected range is ELADMIN v2.7 and earlier. The vulnerable path is a Java web endpoint in me.zhengjie.modules.system.rest.UserController, with business logic in UserServiceImpl.resetPwd, consistent with a Spring-style MVC application. The root cause is an authorization flaw-missing method-level access control plus no role/ownership validation-not a memory corruption or injection issue; it maps to broken access control/missing authorization classes (CWE-862/CWE-639 family), even though the CWE field is N/A in the feed. Exploitation requires only a valid authenticated session (PR:L) and network reachability to the endpoint; no UI or special configuration is needed. The supplied tags list Information Disclosure and N A, which understate the assessed impact: successful exploitation enables credential reset and account takeover.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network web endpoint (AV:N) trivially called (AC:L) by any authenticated account (PR:L, not PR:N); resetting the admin password yields full account takeover, so C/I/A all High.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs no role-level or ownership validation in UserServiceImpl.resetPwd. Any authenticated user of any role can reset the password of arbitrary users, including the built-in administrator.
Executive ViewAI
ELADMIN v2.7 and earlier - an open-source administrative platform used for internal user and account management - contains a broken access control flaw that lets any logged-in user, regardless of privilege level, silently reset the password of any other account, including the built-in administrator. Successful abuse hands an attacker full administrative control of the application and the data it manages, without requiring malware, elevated credentials, or user interaction beyond a valid low-privilege login. Leadership should care because the barrier to entry is minimal for anyone with a legitimate account - a contractor, a self-registered user, or an attacker holding one phished credential - and the consequence is total loss of application-level trust.
No vendor-released patch identified at time of analysis. Interim mitigations: take internet-facing or self-registration-enabled instances offline or restrict them to trusted networks; disable self-service account creation; block or gateway-enforce authorisation on PUT /api/users/resetPwd via reverse proxy or WAF; rotate credentials and enforce multi-factor authentication for administrator and privileged accounts; monitor logs for anomalous password-reset requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB