Improper Authorization in elunez eladmin Email Address Handler

CVE-2025-10014

What is CVE-2025-10014?

A vulnerability was identified in the elunez eladmin platform, specifically within the updateUserEmail function located in the /api/users/updateEmail/ component. This flaw arises from improper authorization handling that may allow an attacker to manipulate the 'id' or 'email' arguments, leading to unauthorized access to user email updates. The attack can be executed remotely; however, it requires knowledge of the RSA-encrypted password associated with the targeted user account, complicating the exploitation. While the detailed exploit has been disclosed, the level of exploitation remains high in complexity, demanding a sophisticated level of access to the victim's credentials.

References