CVE-2026-14949
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A low-privileged remote attacker with a valid session can create new user accounts with arbitrary role values, including the highest privilege level, using the /api/user/add.php endpoint.
Risk Assessment
An attacker can gain full control of the application by creating accounts with administrator privileges, potentially leading to complete security compromise.
Recommendation
Immediately restrict access to /api/user/add.php to authorized administrators only and review and strengthen role controls.
Other vulnerabilities in Unknown Application
See all- CVE-2026-50208Critical
High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES encryption keys, a Man-in-the-Middle attacker can decrypt network traffic.
- CVE-2026-14953Medium
A low-privileged remote attacker can enumerate all configured users and identify accounts with elevated privileges using the endpoint /api/user/fetch-all.php.
- CVE-2025-58581Medium
When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker can thus obtain information about the technology used and the structure of the application.
Original NVD description (English source)
A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS