A flaw in elunez eladmin (up to version 2.7) allows attackers to bypass authorization checks in several controllers, including EmailController, AliPayController, GeneratorController, and GenConfigController. Because the authorization logic can be circumvented, an attacker can invoke privileged actions that should normally be restricted to authenticated or authorized users. This could lead to unauthorized data exposure, manipulation of configuration settings, or execution of functions that affect sensitive business logic. The vulnerability is recognized as an improper authorization weakness, classified under CWE‑266 and CWE‑285.

The affected product is elunez eladmin, versions up to 2.7. Administrators running these versions should examine any exposure of the described controllers and verify whether the application is published in a reachable environment.

The CVSS score of 5.3 indicates medium severity, and the vulnerability is publicly disclosed. The EPSS score is unavailable, so exploitation likelihood cannot be quantified, and it is not included in CISA KEV. The description says the attack can be launched remotely, but it does not state the need for prior authentication. Therefore, it is inferred that the attacker could exploit the missing authorization check with only crafted HTTP/HTTPS requests, possibly without any further prerequisites. Once an endpoint is reachable, the attacker can use the flaw to perform privileged actions such as modifying configuration settings or accessing restricted data.