eladmin CVE-2026-77036

Exploitation requires a valid eladmin user account with at least low-level privileges (PR:L per the CVSS 4.0 vector) - this is not an unauthenticated attack. The attacker must have network access to the eladmin HTTP interface. The vulnerability is specific to four controllers: EmailController, AliPayController, GeneratorController, and GenConfigController; no non-default configuration is required to expose these controllers as they are part of the standard eladmin installation. Factors limiting exploitation: valid application credentials are required; the impact is bounded to low confidentiality, integrity, and availability within the vulnerable system per CVSS metrics; no scope change to external or downstream systems is indicated; and exploitation is constrained to eladmin versions 2.0 through 2.7 specifically.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) characterizes this as moderate severity: network-accessible, low attack complexity, requiring low-privilege authentication, with limited and symmetric confidentiality, integrity, and availability impact and no scope change to downstream systems. The E:P exploit maturity flag aligns with the confirmed public POC on GitHub. This vulnerability is not listed in CISA KEV and no EPSS score was provided in the input data, so exploitation prevalence in the wild cannot be quantified. The primary realistic risk is intra-application privilege escalation: a low-privilege user could reconfigure email or payment settings, or trigger code generation routines, potentially enabling follow-on actions such as credential interception via modified email settings or generation of malicious application artifacts. The limited impact metrics (VC:L/VI:L/VA:L) suggest the blast radius is bounded within the application itself - this is not a direct system-level compromise vector. Overall, real-world risk is moderate: the public POC and zero-response patch status elevate urgency above what raw CVSS alone conveys, but the authentication prerequisite and constrained impact scope prevent this from reaching critical priority.

An attacker with a low-privilege eladmin account sends a crafted HTTP request directly to a restricted controller endpoint such as GeneratorController, bypassing the expected authorization checks since no adequate privilege verification is enforced. With a public POC available via GitHub issue #903, exploitation requires minimal technical sophistication. The attacker could reconfigure email relay settings to intercept application notifications, modify AliPay credentials, or generate server-side code artifacts to probe internal application structure.