HIGH 7.1 NVD
CVE-2026-92603
ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete ot
ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users' messages and announcements. Attackers can supply arbitrary message identifiers in the IdsReq parameter to remove any message row and purge all recipients' read receipts without ownership validation.
References
- https://github.com/continew-org/continew-admin
- https://github.com/continew-org/continew-admin/blob/v4.1.0/continew-system/src/main/java/t
- https://github.com/continew-org/continew-admin/blob/v4.1.0/continew-system/src/main/java/t
- https://github.com/continew-org/continew-admin/commit/665ea2c757a3f1246db62fb139fec1aac3cc
- https://github.com/continew-org/continew-admin/issues/220
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-09-16 via NVD.
vulnfeed aggregates 14597 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.