---
id: CVE-2026-106700
title: >-
  ELADMIN v2.7 and earlier contains an improper access control vulnerability in
  the user-management endpoint PUT /api/users/resetPwd of
  me.zhengjie.modules.system.rest.UserController
summary: >-
  ELADMIN v2.7 and earlier contains an improper access control vulnerability in
  the user-management endpoint PUT /api/users/resetPwd of
  me.zhengjie.modules.system.rest.UserController. The method lacks the
  method-level authorization check a…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N'
cvssSource: cna
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:27:23.392321Z'
published: '2026-10-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:29:12.004Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-106700'
references:
  - url: 'https://github.com/elunez/eladmin'
  - url: 'https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106700.md'
tags:
  - cve.org
epss: 0.00348
epssPercentile: 0.26806
ingestedAt: '2026-10-15T20:29:40.573Z'
---

## Overview

ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs no role-level or ownership validation in UserServiceImpl.resetPwd. Any authenticated user of any role can reset the password of arbitrary users, including the built-in administrator.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.