Is CVE-2026-14949 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-14949?

CVE-2026-14949 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-14949

Description

A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application.