Critical · published January 23, 2026
🚨 An attacker can become the boss without breaking a sweat! This CVE in Dynamicweb (before 9.12.8) allows unauthorized creation of admin users — think of it as giving a stranger the keys to your office without a background check. 🔥 Imagine a hotel where anyone can check in as the manager, bypassing all security protocols. Once they’re in, they can throw a wild party, rearranging everything and inviting whoever they like. That’s what’s at stake here! If exploited, an attacker can create a new admin user without any authentication, leading to total control over the platform. They could upload malicious files and execute commands at will, wreaking havoc and potentially compromising sensitive data. This is absolutely devastating!
Imagine a hotel where anyone can check in as the manager, bypassing all security protocols. Once they’re in, they can throw a wild party, rearranging everything and inviting whoever they like. That’s what’s at stake here! This vulnerability arises from a logic flaw in Dynamicweb that fails to validate whether the setup phases can run again, allowing attackers to add admins without proper verification, leading to unauthorized command execution.
If exploited, an attacker can create a new admin user without any authentication, leading to total control over the platform. They could upload malicious files and execute commands at will, wreaking havoc and potentially compromising sensitive data. This is absolutely devastating! Update your Dynamicweb installation to at least version 9.12.8 or any later versions (like 9.5.9, 9.6.16, or 9.9.8) immediately. Audit your current users for any unauthorized admin accounts to minimize risk. Don't delay — this needs to be fixed ASAP! You’ve got this! Follow the steps to secure your system and earn your hero badge! 🛡️