VULNERABILITY INTELLIGENCE
CVE-2026-46721
EPSS probability0.36%
CISA KEVNot currently listed
Published2026-05-19
Last modified2026-10-26
Description
The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.
Weakness classification
- f4fb688c-4412-4426-b4b8-421ecf27b14a: CWE-639