CVE-2026-92603CWE-639

CVE-2026-92603

Medium · published September 16, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
39.5
In the wild
Unconfirmed
What it is

ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users' messages and announcements. Attackers can supply arbitrary message identifiers in the IdsReq parameter to remove any message row and purge all recipients' read receipts without ownership validation.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00467 · 39.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-16T21:18Z
References (7)
https://github.com/continew-org/continew-admin · [email protected]https://github.com/continew-org/continew-admin/blob/v4.1.0/continew-system/src/main/java/top/continew/admin/system/controller/UserMessageController.java#L93-L97 · [email protected]https://github.com/continew-org/continew-admin/blob/v4.1.0/continew-system/src/main/java/top/continew/admin/system/service/impl/MessageServiceImpl.java#L130-L135 · [email protected]https://github.com/continew-org/continew-admin/commit/665ea2c757a3f1246db62fb139fec1aac3cca296 · [email protected]https://github.com/continew-org/continew-admin/issues/220 · [email protected]https://www.vulncheck.com/advisories/continew-admin-through-4.1.0-unauthorized-message-deletion-via-usermessagecontroller · [email protected]https://github.com/continew-org/continew-admin/issues/220 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 16:03Z
    ContiNew Admin through 4.1.0 Unauthorized Message Deletion via UserMessageController
    cvelistv5