CVE-2026-77036— elunez eladmin GenConfigController improper authorization
Possible ATT&CK Techniques 1AI
T1068 · Exploitation for Privilege EscalationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-77036
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
elunez eladmin GenConfigController improper authorization
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailController/AliPayController/GeneratorController/GenConfigController. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-77036
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77036
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-77036 (1)
Vendor Pages for CVE-2026-77036 (1)
IV. Related Vulnerabilities
Same product: eladmin
- CVE-2026-10550
elunez eladmin Application Deployment App.java command injec - CVE-2026-8127
eladmin Users API Endpoint UserController.java checkLevel ac - CVE-2025-10084
elunez eladmin SysLogController 1 queryErrorLogDetail improp - CVE-2025-10014
elunez eladmin Email Address updateEmail updateUserEmail imp - CVE-2025-9937
elunez eladmin LocalStorageController deleteFile improper au
Same vendor: elunez
- CVE-2026-10550
elunez eladmin Application Deployment App.java command injec - CVE-2025-10084
elunez eladmin SysLogController 1 queryErrorLogDetail improp - CVE-2025-10014
elunez eladmin Email Address updateEmail updateUserEmail imp - CVE-2025-9937
elunez eladmin LocalStorageController deleteFile improper au - CVE-2025-9241
elunez eladmin exportUser csv injection
Same weakness: CWE-285
- CVE-2026-77795
Dromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController - CVE-2026-77686
Dolibarr Account card.php improper authorization - CVE-2026-66722
Apache CloudStack: ProjectRole & ProjectRolePermission autho - CVE-2026-54624
django CMS: Structure endpoint bypasses page-view permission - CVE-2026-18283
Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerab
V. Comments for CVE-2026-77036
No comments yet