cve.bz

CVE-2026-92603

7.1 highEPSS 0.5%

High (7.1). EPSS 0.5% chance of exploitation in the next 30 days.

ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users' messages and announcements. Attackers can supply arbitrary message identifiers in the IdsReq parameter to remove any message row and purge all recipients' read receipts without ownership validation.

Severity

CVSS 4.0

7.1 high
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.5 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS
0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
CWE
CWE-639
Published
Modified
Record from
the NVD, synced

References

Check your stackJSON