CVE-2026-8127

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability has been found in eladmin up to 2.7. Impacted is the function checkLevel of the file /rest/UserController.java of the component Users API Endpoint. Such manipulation leads to improper access controls. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-266CWE-284

Affected software

No affected versions have been published.

Timeline

Published
May 8, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-812707.5Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended CVE-2026-812718.8Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.CVE-2026-812724.9Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.CVE-2026-812738.1Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.CVE-2026-812745.3Subscriber Broken Access Control in Ditty <= 3.1.67 versions.CVE-2026-812756.5Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions.CVE-2026-812765.3Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.CVE-2026-812778.5Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.CVE-2026-812785.4Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This isCVE-2026-812795.4Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.CVE-2026-81287.3A vulnerability was found in SourceCodester SUP Online Shopping 1.0. The affected element is an unknown function of the file /admin/viewmsg.CVE-2026-812806.5Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions.