CVE-2026-14949: Privilege Escalation Vulnerability

CVE-2026-14949 Overview

CVE-2026-14949 is a broken access control vulnerability [CWE-863] in a web application's user creation endpoint at /api/user/add.php. A low-privileged remote attacker with a valid session can submit crafted requests to create new accounts with arbitrary role values. The endpoint fails to enforce authorization on the role parameter, allowing assignment of the application's highest privilege level. This turns any authenticated low-privileged user into a full administrator, breaking the application's role-based access model.

Critical Impact
Any authenticated user can create new administrator accounts, resulting in complete compromise of the application's authorization boundary.

Affected Products

Affected product details are published in CERT-VDE Advisory VDE-2026-078. Specific vendor, product, and version data were not populated in the NVD entry at the time of publication.

Discovery Timeline

2026-08-20 - CVE CVE-2026-14949 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-14949

Vulnerability Analysis

The flaw resides in the user creation handler exposed at /api/user/add.php. The endpoint accepts a role or privilege parameter from the client and writes it directly to the new user record without validating whether the requesting session is authorized to assign that role.

An authenticated attacker with the lowest available privilege can invoke the endpoint and specify the administrator role in the request body. The server processes the request as legitimate because session authentication succeeds. It never checks that the caller possesses the authority to grant elevated privileges to other accounts.

This is a classic authorization gap: authentication is enforced, but function-level and field-level authorization on the role assignment are missing. The result is a horizontal-to-vertical privilege escalation primitive that persists across sessions, since the attacker creates a brand-new privileged account under their control.

Root Cause

The root cause is incorrect authorization [CWE-863]. The application trusts client-supplied role values without verifying the caller's permission to assign them. Access control checks are limited to session validity rather than role-based enforcement on the specific action.

Attack Vector

Exploitation requires network access to the API and a valid low-privileged session. The attacker sends an HTTP request to /api/user/add.php containing standard user fields along with a role value corresponding to the highest privilege level. The application creates the account, and the attacker authenticates as the new administrator to gain full control of application data and functionality. Refer to the CERT-VDE Advisory VDE-2026-078 for technical specifics.

Detection Methods for CVE-2026-14949

Indicators of Compromise

Unexpected new accounts created with administrator or elevated role values in the application user table.
HTTP POST requests to /api/user/add.php originating from sessions belonging to low-privileged users.
Login events from newly created privileged accounts shortly after low-privileged account activity from the same source address.

Detection Strategies

Audit application logs for calls to /api/user/add.php and correlate the caller's role with the role value assigned in the request body.
Alert when any account other than an existing administrator successfully invokes the user creation endpoint.
Baseline normal administrator account creation frequency and flag deviations.

Monitoring Recommendations

Forward application and web server access logs to a centralized analytics platform for correlation across authentication and privilege change events.
Monitor for privilege escalation patterns where a session-holding user creates an account that then authenticates from the same client fingerprint.
Track changes to the user directory and generate alerts on any new account assigned the highest role.

How to Mitigate CVE-2026-14949

Immediate Actions Required

Apply the vendor patch referenced in CERT-VDE Advisory VDE-2026-078 as soon as it is available for your deployment.
Review all user accounts and remove any unauthorized administrator or privileged accounts.
Rotate credentials and session tokens for administrator accounts if suspicious account creation is observed.

Patch Information

Refer to CERT-VDE Advisory VDE-2026-078 for vendor-supplied patch details and fixed version information. The NVD entry does not list specific fixed versions at the time of publication.

Workarounds

Restrict network access to /api/user/add.php at the reverse proxy or web application firewall so only administrator source IPs or authenticated administrator sessions can reach it.
Enforce server-side validation that rejects user creation requests when the caller's role is below the required administrative level.
Temporarily disable self-service or low-privilege API access to user management endpoints until the patch is applied.

bash

# Example WAF rule concept: block non-admin sessions from reaching the user creation endpoint
# Pseudocode - adapt to your WAF syntax
if request.path == "/api/user/add.php" and session.role != "admin":
    action = block
    log   = "CVE-2026-14949 attempted privilege escalation"