[Security] Broken Access Control - LocalStorageController
Author: StephenClashCreated Jul 1, 2026Updated Jul 1, 2026
- Name of software: eladmin
- Project Link: https://github.com/elunez/eladmin
- Affected Version: latest
- Vulnerability Type: Broken Access Control / Function Level Authorization Bypass (CWE-284)
- Vulnerability description and hazards: The local storage deletion endpoint allows any authenticated low-privilege user to delete another user's file record by ID. The actual reproduction chain shows that an
adminuser creates the target file, and then a different authenticated low permissions account deletes the record throughDELETE /api/localStorage. The victim-side list snapshot changes from one record to zero records, proving that the unauthorized deletion succeeds. - Vulnerability analysis and reproduction reports: https://drive.google.com/file/d/1Dmv8jze4jPou7iWaHcCB82v24MS7yPG4/view?usp=drive_link
Source: elunez/eladmin