CVE-2026-46721
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
May 19, 2026
Vendor
unknown
Description
The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.