Skip to main content

eladmin CVE-2026-77036

| EUVDEUVD-2026-63491 LOW
Improper Authorization (CWE-285)
2026-08-20 VulDB GHSA-782r-wf8m-ggvv
Authentication Bypass Eladmin
2.1
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
2.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.3 MEDIUM

Network-accessible requiring low-privilege authentication; no scope change; limited symmetric C/I/A impact consistent with intra-application privilege abuse across the four affected controllers.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Severity Changed
Aug 20, 2026 - 18:22 NVD
MEDIUM LOW
CVSS changed
Aug 20, 2026 - 18:22 NVD
5.3 (MEDIUM) 2.1 (LOW)
Analysis Generated
Aug 20, 2026 - 18:21 vuln.today
CVE Published
Aug 20, 2026 - 17:30 cve.org
MEDIUM 5.3

DescriptionCVE.org

A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailController/AliPayController/GeneratorController/GenConfigController. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Improper authorization in elunez eladmin versions 2.0 through 2.7 allows low-privileged remote attackers to invoke restricted controller functions - EmailController, AliPayController, GeneratorController, and GenConfigController - without adequate permission enforcement. A publicly available proof-of-concept exploit (GitHub issue #903) lowers the barrier to abuse, and no vendor patch has been issued; the project maintainer has not responded to the disclosure filed via VulDB. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege eladmin account
Delivery
Send crafted HTTP request to restricted controller
Exploit
Bypass missing authorization check
Execution
Access or modify email/payment/code-generation configuration
Impact
Leverage modified configuration for follow-on action
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid eladmin user account with at least low-level privileges (PR:L per the CVSS 4.0 vector) - this is not an unauthenticated attack. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) characterizes this as moderate severity: network-accessible, low attack complexity, requiring low-privilege authentication, with limited and symmetric confidentiality, integrity, and availability impact and no scope change to downstream systems. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a low-privilege eladmin account sends a crafted HTTP request directly to a restricted controller endpoint such as GeneratorController, bypassing the expected authorization checks since no adequate privilege verification is enforced. With a public POC available via GitHub issue #903, exploitation requires minimal technical sophistication. …
Remediation No vendor-released patch has been identified at time of analysis - the project maintainer has not responded to the disclosure submitted via GitHub issue https://github.com/elunez/eladmin/issues/903. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Eladmin

View all
CVE-2024-44677 CRITICAL POC
9.8 Sep 10

eladmin v2.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrar
CVE-2024-51243 HIGH POC
7.2 Oct 30

The eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can control all application deploy
CVE-2025-70997 MEDIUM POC
6.5 Feb 04

A vulnerability has been discovered in eladmin v2.7 and before. This vulnerability allows for an arbitrary user password
CVE-2024-51242 MEDIUM POC
6.5 Oct 30

A Server-Side Request Forgery (SSRF) vulnerability has been identified in eladmin 2.7 and earlier in ServerDeployControl
CVE-2025-2855 MEDIUM POC
5.1 Mar 27

A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Rated medium severity

CVE-2024-7458 MEDIUM POC
5.1 Aug 04

A vulnerability was found in elunez eladmin up to 2.7 and classified as critical. Rated medium severity (CVSS 5.1), this
CVE-2024-44676 MEDIUM POC
4.8 Sep 10

eladmin v2.7 and before is vulnerable to Cross Site Scripting (XSS) which allows an attacker to execute arbitrary code v
CVE-2026-10550 LOW POC
2.1 Jun 02

Command injection in elunez eladmin's Application Deployment Module (App.java) allows authenticated remote attackers wit
CVE-2025-9239 MEDIUM POC
6.3 Aug 20

A vulnerability was identified in elunez eladmin up to 2.7. Rated medium severity (CVSS 6.3), this vulnerability is remo
CVE-2025-8530 MEDIUM POC
5.5 Aug 04

A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Rated medium severity

CVE-2025-3250 MEDIUM
5.3 Apr 04

A vulnerability, which was classified as problematic, has been found in elunez eladmin 2.7. Rated medium severity (CVSS

CVE-2025-22978 CRITICAL POC
9.8 Feb 03

eladmin <=2.7 is vulnerable to CSV Injection in the exception log download module. Rated critical severity (CVSS 9.8), t

Same weakness CWE-285 – Improper Authorization

View all
CVE-2025-29927 CRITICAL POC
9.1
CVE-2016-5676 HIGH POC
7.5
CVE-2025-66301 CRITICAL POC
9.6
CVE-2023-32707 HIGH POC
8.8
CVE-2016-3352 HIGH
8.8
CVE-2025-29659 CRITICAL POC
9.8
CVE-2022-2595 CRITICAL POC
10.0
CVE-2026-30956 CRITICAL POC
9.9

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-77036 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy