ELADMIN (eladmin‑mp) up to version 2.7 exposes an improper access control flaw in its role management module. The PUT /api/roles/menu endpoint authorizes a request by only comparing the target role’s level with the caller’s minimum level, without validating the supplied menu set or preventing the caller from editing their own role. A logged‑in user who has the delegated roles:edit permission can therefore submit the ID of their own role together with an arbitrary list of menu IDs. This allows the user to augment their own privileges or grant themselves access to restricted functionality, effectively escalating privileges within the application.

All installations of ELADMIN (eladmin‑mp) running versions up to 2.7 are affected. The vulnerability exists in the RoleController.updateRoleMenu endpoint within the role management module.

The vulnerability carries a CVSS score of 8.8, indicating high severity. While the EPSS score is not available, the absence of this metric does not diminish the risk posed by the flaw. The flaw is not listed in CISA’s KEV catalog. Exploitation requires an authenticated session with roles:edit permission, a condition that is likely satisfied by many users. An attacker can manipulate the menu assignment to elevate privileges or gain additional UI functionality, potentially compromising confidential data or achieving further malicious actions within the application.