In eladmin, the function checkLevel in the Users API Endpoint allows an attacker to manipulate request parameters to force the server to treat a lower privilege user as a higher privilege user. The flaw is an improper access control weakness, classified as CWE‑266 and CWE‑284. If exploited, an attacker could read or modify sensitive data, gain unauthorized administrative capabilities, or otherwise compromise user information protected by the application.

The vulnerability affects the eladmin web administration product in all releases up to version 2.7. No specific fixed version has been released yet, and the vendor has not responded to the issue report, so all installations running 2.7 or earlier remain vulnerable.

The CVSS score of 5.3 indicates moderate severity. Although an EPSS score is not available, the vulnerability is listed as not present in the CISA KEV catalog. The attack can be carried out remotely by sending crafted requests to the /rest/UserController endpoint. Because no patch is currently available, the primary risk is that any authenticated user could elevate privileges if the application logic does not properly validate the required level.