CVE-2026-14949 in FDS
Summary
by MITRE • 08/20/2026
A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability described constitutes an insecure direct object reference combined with broken access control within the web application's user management subsystem. Specifically, the endpoint located at /api/user/add.php fails to enforce proper authorization checks when processing requests for new account creation. This flaw allows a low-privileged remote attacker who has established a valid session to manipulate input parameters associated with role assignment during the registration or addition process. By altering these parameters, typically through HTTP request modification tools such as Burp Suite or OWASP ZAP, an adversary can inject arbitrary values into the user profile data structure. The critical nature of this flaw lies in its ability to bypass privilege escalation controls entirely, enabling the creation of new administrative accounts with elevated permissions that should be restricted to authorized system administrators only.
From a technical perspective, this issue stems from a lack of server-side validation regarding role hierarchy and permission levels during the account provisioning workflow. The application likely trusts client-supplied data for role designation without cross-referencing it against an authoritative list of permissible roles or verifying whether the requesting user possesses the requisite privileges to assign such roles. This design pattern violates fundamental security principles by assuming that session validity equates to functional authority, rather than strictly enforcing least privilege constraints at every step of the request lifecycle. The absence of robust input sanitization and authorization middleware means that any authenticated user can effectively promote themselves or create new high-privilege entities within the system architecture.
The operational impact of this vulnerability is severe, as it directly compromises the integrity and confidentiality of the entire application environment. An attacker gaining administrative access through this method can perform actions reserved for trusted personnel, including modifying system configurations, accessing sensitive user data, executing arbitrary code if other vulnerabilities exist in admin panels, or disabling security logging mechanisms to cover their tracks. This effectively results in a complete takeover of the web application's control plane. Furthermore, because new accounts are created with valid credentials, persistence is achieved without requiring further exploitation steps, allowing long-term unauthorized access and potential lateral movement within connected network segments if those administrative privileges extend beyond the immediate application boundary.
This vulnerability aligns closely with CWE-269, which addresses Improper Privilege Assignment, where a user is assigned to an incorrect security role or privilege level that exceeds their intended authorization scope. Additionally, it maps directly to MITRE ATT&CK technique T1078, specifically Valid Accounts, as the attacker leverages legitimate credentials to gain unauthorized access and maintain persistence within the target system. The exploitation vector falls under Remote Code Execution prerequisites in many contexts due to the administrative capabilities gained, though strictly speaking, this is an Access Control bypass leading to privilege escalation via account manipulation rather than direct code execution at the OS level.
Mitigation strategies must focus on implementing strict server-side authorization checks for all role assignment operations. Developers should ensure that only users with explicit admin privileges can create or modify user accounts and assign roles. The application logic must validate incoming requests against a predefined, immutable list of allowed role identifiers rather than accepting arbitrary input values. Implementing principle of least privilege throughout the authentication and authorization modules is essential to prevent such escalations. Additionally, employing multi-factor authentication for administrative actions and auditing all account creation events can help detect and deter attempts at unauthorized privilege escalation. Regular security testing using static application security testing tools and dynamic analysis should be integrated into the development lifecycle to identify similar access control flaws before deployment.