CVE-2026-46721 | BDVDB-2026-334041 Detail

Description#

The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-05-19Record published in the CVE List.