CVE-2026-48900
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.
Risk Assessment
Users without proper permissions can modify task types, potentially leading to unauthorized changes in scheduling and disruption of operations.
Recommendation
Apply vendor patches and review/strengthen access controls for scheduler task management.
Other vulnerabilities in userSpice
See all- CVE-2018-25350Critical
userSpice 4.3.24 has a username enumeration vulnerability. An unauthenticated attacker can send POST requests to existingUsernameCheck.php and analyze responses to find existing accounts.
- CVE-2018-25349Medium
userSpice 4.3.24 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the X-Forwarded-For HTTP header, which execute when administrators visit the audit log page.
Original NVD description (English source)
An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.