CVE-2026-14953
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A low-privileged remote attacker can enumerate all configured users and identify accounts with elevated privileges using the endpoint /api/user/fetch-all.php.
Risk Assessment
Disclosure of user list and their privileges may facilitate targeted attacks such as phishing or privilege escalation attempts.
Recommendation
Restrict access to the /api/user/fetch-all.php endpoint to authorized administrators only and implement authentication and authorization mechanisms.
Other vulnerabilities in Unknown Application
See all- CVE-2026-50208Critical
High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES encryption keys, a Man-in-the-Middle attacker can decrypt network traffic.
- CVE-2026-14949Medium
A low-privileged remote attacker with a valid session can create new user accounts with arbitrary role values, including the highest privilege level, using the /api/user/add.php endpoint.
Original NVD description (English source)
A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php.