The vulnerability is a broken access control in eladmin versions up to 2.7. Write handlers for /api/users bypass department checks, enabling users with user:edit or user:del permissions to modify or delete accounts in other departments. This can lead to unauthorized account disabling, reassignment, or removal, potentially compromising confidentiality and integrity of user data for affected departments.

elunez’s eladmin application, versions through 2.7, is affected. The specific endpoint is /api/users used for update and delete operations.

The CVSS score of 5.1 indicates medium severity. EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. Attackers with appropriate permissions could remotely send PUT or DELETE requests to the API endpoint to affect accounts beyond the intended scope.