Authenticated Administrator escalation via unfiltered isAdmin assignment

Privilege escalation in elunez ELADMIN 2.0 through 2.7 allows remote authenticated users with user:add access to gain Administrator privileges. UserController.createUser binds the request body directly to a User entity, while checkLevel ignores isAdmin and UserServiceImpl.create persists the attacker-supplied flag. The attacker needs an account with user:add permission; a created user with isAdmin=true receives the admin authority that bypasses endpoint permission checks.