https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 04:37:59 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-111604 <p>eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target user ids to disable, reassign, alter, or delete accounts in other departments.</p> <p>eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target user ids to disable, reassign, alter, or delete accounts in other departments.</p> https://db.gcve.eu/vuln/fkie_cve-2026-111604 https://db.gcve.eu/vuln/ghsa-7qp5-57jr-xmpr <p>eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target user ids to disable, reassign, alter, or delete accounts in other departments.</p> <p>eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target user ids to disable, reassign, alter, or delete accounts in other departments.</p> https://db.gcve.eu/vuln/ghsa-7qp5-57jr-xmpr