Is CVE-2026-77036 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77036 being exploited in the wild.

How severe is CVE-2026-77036?

Medium severity, with a CVSS score of 6.3, published 20 August 2026.

Is there a fix for CVE-2026-77036?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-77036 attacked?

It is attacked over the network.

Am I affected by CVE-2026-77036?

Check whether you run Elunez Eladmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77036: elunez eladmin improper authorization in multiple controllers

CVE-2026-77036 · Severity: medium · CVSS 6.3 · Published 2026-08-20

eladmin is a Java-based backend management system built on Spring Boot and Spring Security used to manage administrative functions and role-based access control. The vulnerability allows unauthorized users to bypass access controls on critical administrative functions (email configuration, payment processing, and code generation) by making direct requests to unprotected API endpoints, enabling privilege escalation and unauthorized system manipulation.

Technologies: Elunez Eladmin. Vendors: Elunez.

Quick answers

Is CVE-2026-77036 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77036 being exploited in the wild.
How severe is CVE-2026-77036?: Medium severity, with a CVSS score of 6.3, published 20 August 2026.
Which products and versions are affected?: Elunez Eladmin up to 2.7.
Is there a fix for CVE-2026-77036?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-77036 attacked?: It is attacked over the network.
Am I affected by CVE-2026-77036?: Check whether you run Elunez Eladmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper authorization flaw in eladmin's EmailController, AliPayController, GeneratorController, and GenConfigController endpoints. These controllers lack proper Spring Security authorization checks, allowing any authenticated or unauthenticated user to invoke administrative functions intended only for privileged roles. The flaw can be exploited remotely by sending HTTP requests directly to the affected endpoints, bypassing role-based access controls (RBAC). An attacker can escalate privileges, modify email and payment configurations, or generate unauthorized code. No patch has been released at the time of the advisory.

Affected products

elunez eladmin up to 2.7

Timeline

2026-06-03: disclosed: Vulnerability reported via GitHub issue #903
2026-08-20: advisory: CVE-2026-77036 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.