Executive brief
eladmin is a Java-based backend management system built on Spring Boot and Spring Security used to manage administrative functions and role-based access control. The vulnerability allows unauthorized users to bypass access controls on critical administrative functions (email configuration, payment processing, and code generation) by making direct requests to unprotected API endpoints, enabling privilege escalation and unauthorized system manipulation.
Technical details
The vulnerability is an improper authorization flaw in eladmin's EmailController, AliPayController, GeneratorController, and GenConfigController endpoints. These controllers lack proper Spring Security authorization checks, allowing any authenticated or unauthenticated user to invoke administrative functions intended only for privileged roles. The flaw can be exploited remotely by sending HTTP requests directly to the affected endpoints, bypassing role-based access controls (RBAC). An attacker can escalate privileges, modify email and payment configurations, or generate unauthorized code. No patch has been released at the time of the advisory.
Affected products
- elunez eladmin up to 2.7
Timeline
- 2026-06-03: disclosed: Vulnerability reported via GitHub issue #903
- 2026-08-20: advisory: CVE-2026-77036 published