CVE-2026-77036

MEDIUM 6.3

elunez eladmin GenConfigController improper authorization

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailController/AliPayController/GeneratorController/GenConfigController. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-285 CWE-266
Vendor	elunez
Product	eladmin
Published	Aug 20, 2026

Stay Ahead of the Next One

Get instant alerts for elunez eladmin

Be the first to know when new medium vulnerabilities affecting elunez eladmin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

elunez / eladmin

2.0 2.1 2.2 2.3 2.4 2.5 2.6 2.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/393643 vuldb.com: https://vuldb.com/vuln/393643/cti vuldb.com: https://vuldb.com/cve/CVE-2026-77036 vuldb.com: https://vuldb.com/submit/880860 github.com: https://github.com/elunez/eladmin/issues/903 github.com: https://github.com/elunez/eladmin/

Credits

🔍 geochen (VulDB User) VulDB CNA Team