PULSE
ES
FEED
ransomn0n reclama a Prafesta Ind. e Com. de Embalagens Ltda · BR · Manufacturingransomplay reclama a WSBI-ESBG · BE · Financial Servicesransomplay reclama a New Tec Tool Limited · HK · Manufacturingransomplay reclama a MicroSearch Corporation · Technologyransomplay reclama a Pure Options · Financial Servicesransomredact reclama a ONEOK, Inc. · US · Energy & Utilitiesransomvexy ransomware reclama a Data-Core Systems · Technologyransomwallstreet reclama a Girl Scouts of Eastern Massachusetts · US · Educationransomn0n reclama a Company #80 · Not Foundransomn0n reclama a Company #79 · US · Not Foundransomn0n reclama a Company #78 · Not Foundransomn0n reclama a Company #77 · US · Not Foundransomn0n reclama a Company #76 · US · Not Foundransomn0n reclama a Company #72 · Not Foundransomn0n reclama a Prafesta Ind. e Com. de Embalagens Ltda · BR · Manufacturingransomplay reclama a WSBI-ESBG · BE · Financial Servicesransomplay reclama a New Tec Tool Limited · HK · Manufacturingransomplay reclama a MicroSearch Corporation · Technologyransomplay reclama a Pure Options · Financial Servicesransomredact reclama a ONEOK, Inc. · US · Energy & Utilitiesransomvexy ransomware reclama a Data-Core Systems · Technologyransomwallstreet reclama a Girl Scouts of Eastern Massachusetts · US · Educationransomn0n reclama a Company #80 · Not Foundransomn0n reclama a Company #79 · US · Not Foundransomn0n reclama a Company #78 · Not Foundransomn0n reclama a Company #77 · US · Not Foundransomn0n reclama a Company #76 · US · Not Foundransomn0n reclama a Company #72 · Not Found
← All CVEs
CVE WatchOct 16, 2026

CVE-2026-106705

ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/

CVSS

8.8

High

EPSS

—

KEV

—

Exploit Today

0

0-100

Published: Oct 16, 2026 · Last modified: Oct 16, 2026 · CWE-284

EPSS · 30d

Not enough EPSS history yet.

Technical description

ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither validates the granted menu set nor prevents a caller from modifying its own role. A logged-in non-admin user whose role holds the delegated `roles:edit` permission can submit its own role id together with an arbitrary list of menu ids.

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-617268.1 HIG
—
———Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{step_id}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12.10hCVE-2026-170735.4 MED
—
——0IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution.10hCVE-2026-887557.8 HIG
—
——0Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.10hCVE-2026-1113885.4 MED
6.4%
——2Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions.13hCVE-2026-61610—
12.9%
——4Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved() invokes SetPhotosHighlightedRequest::processValidatedValues() before authorization, and PhotoPolicy::canHighlight() returns true for anonymous callers without a canSee check. An unauthenticated attacker who can guess photo identifiers can distinguish existing private photos through differing success and not-found responses and can change their is_highlighted state, including for photos in private or password-protected albums. The issue is limited to installations using the non-default anonymous star-visibility setting. This issue is fixed in version 7.6.1.1dCVE-2026-97037.1 HIG
8.5%
——3Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request. Exploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other privileges are needed. Both Grafana OSS and Grafana Enterprise are affected. The defect is in Grafana's data source proxy; Loki itself is not vulnerable and does not need to be patched.10h