Eladmin v2.7 and older expose a flaw in the /api/users/resetPwd endpoint that bypasses normal method‑level authorization checks and ignores role or ownership validation. Because any authenticated user can call this endpoint, an attacker can reset the passwords of any account, including the privileged administrator account. Once the attacker has a valid password, they can log in with any user identity, giving them full access to the application and potentially the underlying system.

The vulnerability affects the ELADMIN application, specifically versions 2.7 and earlier. No additional version range is listed; affected builds should be identified by checking the deployed ELADMIN package version.

The CVSS score of 8.8 indicates a high severity; the EPSS score is less than 1 % and the vulnerability is not listed in CISA’s KEV catalog, which suggests exploitation is currently unlikely but remains theoretically possible. Attackers need only be authenticated, which is commonly trivial in many user‑management contexts, and can then reset any user’s password by requesting the PUT /api/users/resetPwd endpoint. The lack of role‑level controls means the trick can be lifted at any time, making it a straightforward privilege‑escalation vector.