CVE-2026-14953
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A low-privileged remote attacker can enumerate all configured users and identify accounts with elevated privileges using the endpoint /api/user/fetch-all.php.
Risk Assessment
Disclosure of user list and their privileges may facilitate targeted attacks such as phishing or privilege escalation attempts.
Recommendation
Restrict access to the /api/user/fetch-all.php endpoint to authorized administrators only and implement authentication and authorization mechanisms.
Other vulnerabilities in Unknown Application
See all- CVE-2026-50208Critical
High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES encryption keys, a Man-in-the-Middle attacker can decrypt network traffic.
- CVE-2026-14949Medium
A low-privileged remote attacker with a valid session can create new user accounts with arbitrary role values, including the highest privilege level, using the /api/user/add.php endpoint.
- CVE-2025-58581Medium
When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker can thus obtain information about the technology used and the structure of the application.
Original NVD description (English source)
A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS