CVE-2026-92603 in Admin
Summary
by MITRE • 09/16/2026
ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users' messages and announcements. Attackers can supply arbitrary message identifiers in the IdsReq parameter to remove any message row and purge all recipients' read receipts without ownership validation.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified security flaw within ContiNew Admin versions up to 4.1.0 represents a critical failure in server-side access control mechanisms, specifically targeting the personal message deletion endpoint. This vulnerability stems from an authorization bypass where the application fails to validate whether the authenticated user initiating the request is the legitimate owner of the target resource. In secure software design, every action that modifies or deletes data must be accompanied by rigorous ownership verification to ensure that users can only interact with resources explicitly assigned to their account. The absence of this check allows any logged-in individual to manipulate system state beyond their intended permissions, fundamentally breaking the principle of least privilege and undermining the integrity of the application's security model.
Technically, the exploitation vector relies on manipulating the IdsReq parameter within HTTP requests directed at the message deletion API. By supplying arbitrary identifiers that correspond to messages belonging to other users or system-wide announcements, an attacker can force the server to execute a delete operation without verifying ownership. This lack of validation means the backend processes the request based solely on the presence of valid authentication credentials rather than checking if those credentials match the resource owner. Consequently, the application treats any provided identifier as legitimate for deletion regardless of its association with other accounts or administrative announcements, leading to unauthorized data modification and destruction.
The operational impact of this vulnerability is significant, affecting both confidentiality and integrity aspects of information security. Attackers can selectively delete private communications between specific users, potentially disrupting business operations, destroying evidence in legal or compliance contexts, or causing interpersonal conflicts within the organization. Furthermore, because the flaw extends to system announcements, malicious actors can remove critical notifications intended for all recipients, such as maintenance warnings, policy updates, or emergency alerts. The deletion of these messages also purges read receipts associated with them, which may interfere with audit trails and monitoring systems that rely on user engagement metrics to track communication visibility. This capability effectively allows an attacker to erase digital footprints and manipulate the perceived state of system communications without detection through standard access logs alone.
From a classification perspective, this vulnerability aligns directly with CWE-284, which describes Improper Access Control, specifically highlighting failures in authorization checks that allow users to perform actions outside their intended privileges. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, as the exploitation requires initial authentication but leverages those credentials to escalate access beyond normal user boundaries by bypassing object-level permissions. The scenario illustrates a common pattern where session management is secure at the login level but fails during resource-specific operations due to insufficient input validation regarding ownership relationships.
To mitigate this vulnerability, immediate patching to a version of ContiNew Admin greater than 4.1.0 is required if available from the vendor. In environments where patching is not immediately feasible, defensive measures should focus on implementing strict server-side authorization checks for all delete operations involving user-generated content or system announcements. Developers must ensure that every request to modify data includes a verification step confirming that the authenticated session's identity matches the owner field of the target resource in the database. Additionally, deploying Web Application Firewalls with rules designed to detect anomalous patterns in API parameter manipulation can provide an additional layer of defense by flagging requests where non-owner identifiers are submitted for deletion operations. Regular security audits and penetration testing should also be conducted to identify similar authorization bypasses across other endpoints within the application ecosystem.