Security Advisory
CVE-2026-14949
6.5
MEDIUM
Vulnerability Description
A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application.
Published Date
August 20, 2026
Official Source
NIST NVD Advisory