CVE-2026-111604 published: eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissi...