medium6.5
CVE-2026-14949
A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new a…
Impact
A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.