Is there a public PoC exploit available for EUVD-2026-28487?

Yes, a public proof-of-concept exploit is available for EUVD-2026-28487. Prioritise patching immediately. EPSS: 0.0%.

eladmin EUVD-2026-28487

Q: What is the CVSS score of EUVD-2026-28487?

EUVD-2026-28487 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-8127 LOW

Improper Access Control (CWE-284)

2026-05-08 VulDB

GHSA-7rvc-3rgf-7589

Authentication Bypass Java

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 03:30 vuln.today

Severity Changed

May 08, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

May 08, 2026 - 03:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

CVE Published

May 08, 2026 - 02:00 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability has been found in eladmin up to 2.7. Impacted is the function checkLevel of the file /rest/UserController.java of the component Users API Endpoint. Such manipulation leads to improper access controls. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Improper access controls in eladmin up to version 2.7 allow authenticated remote attackers to bypass user level checks through the checkLevel function in the Users API Endpoint (/rest/UserController.java), resulting in unauthorized access to resources. Publicly available exploit code exists, and the vendor has not responded to early notification of the vulnerability.

Technical ContextAI

eladmin is a Java-based administrative management system. The vulnerability resides in the checkLevel function of the UserController class, which implements access control logic for user privilege validation. The improper implementation of this function (CWE-284: Improper Access Control) fails to properly restrict access based on user roles or privilege levels, allowing authenticated users to bypass intended authorization checks. The vulnerable code is exposed through the REST API endpoint at /rest/UserController.java, making it remotely accessible to any authenticated user with network connectivity to the application.

RemediationAI

Upgrade eladmin to a patched version beyond 2.7 once available. No specific patched version is currently confirmed by the vendor, as they have not responded to the early notification. In the interim, implement network-level access controls to restrict access to the /rest/UserController.java endpoint to trusted internal users only, reducing exposure to low-privilege authenticated attackers. Additionally, conduct a code review of the checkLevel function and apply principle of least privilege to all API endpoints that perform authorization checks. Monitor logs for suspicious access patterns to the UserController endpoint, particularly attempts by low-privilege accounts to access resources beyond their assigned role. These compensating controls reduce exploitation likelihood but do not eliminate the underlying flaw-patching remains the primary remediation once a vendor release is available. Refer to the GitHub issue at https://github.com/elunez/eladmin/issues/897 for updates on vendor response and patch release.