CVE-2026-14850

HighCVSS 8.8

Published: 17/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 17/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

The password reset functionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership.

Risk Assessment

An attacker can take over any user account, including administrative accounts, by resetting the password without ownership verification. This leads to full account takeover and potential compromise of the entire system.

Recommendation

Immediately implement a fix validating the user_id parameter in the password reset function. Ensure that password reset requires account ownership verification (e.g., via a token sent to email).

Other vulnerabilities in Password reset functionality

CVE-2026-108335Critical
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge. An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection; device credentials and customer data cannot be accessed with this vulnerability.

Original NVD description (English source)

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS