eladmin CVE-2026-108706

Requires a valid authenticated eladmin account of any privilege level (PR:L) - the flaw is that the downloadS3Storage handler omits the storage-permission check, so the account does NOT need storage privileges. The concrete prerequisites are: network access to the /api/s3Storage/download/{id} endpoint, a usable session/token for any user, and sequentially-assigned object IDs that permit enumeration. The key limiting factor on impact is bucket configuration: object URLs are always leaked, but actual file-content disclosure only occurs when the referenced S3 buckets are publicly readable; private buckets reduce the impact to URL/metadata exposure. Authentication is the primary barrier - a fully unauthenticated attacker cannot reach the handler.

This is a genuine but moderate-severity information-disclosure issue, not a top-priority emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 and is internally consistent with the description: network-reachable, low complexity, but requiring low-privilege authentication (PR:L) and yielding only limited confidentiality impact (VC:L) with no integrity or availability effect. Exploit code is publicly available (VulnCheck advisory plus a GitHub PoC), which raises practical likelihood, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation - PoC availability and active exploitation are distinct signals and should not be conflated. The CWE-862 (missing authorization) root cause combined with sequential-ID enumeration (an IDOR pattern) makes exploitation reliable once an attacker has any valid account. The real-world impact is amplified or dampened entirely by an external factor the CVE itself does not control: full file-content exposure occurs only when the backing S3 buckets are publicly readable; otherwise the flaw leaks object URLs/metadata but not necessarily contents. Net: a confirmed, easily-automated authorization gap worth patching promptly, but it depends on prior authentication and on bucket configuration, which keeps it below critical priority.

A low-privileged authenticated user (or an attacker who has obtained any valid eladmin account) scripts GET /api/s3Storage/download/{id} across sequential IDs to harvest the stored object URLs for every uploaded file, bypassing the intended storage-permission check. If the underlying S3 buckets are publicly readable, the attacker then retrieves the actual file contents. A public PoC (poc_s3Storage_download.py) already automates this enumeration.