CVE-2026-14949
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Aug 20, 2026
Vendor
unknown
Description
A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application.