CVE-2026-92603
ContiNew Admin through 4.1.0 Unauthorized Message Deletion via UserMessageController
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users' messages and announcements. Attackers can supply arbitrary message identifiers in the IdsReq parameter to remove any message row and purge all recipients' read receipts without ownership validation.
| CWE | CWE-639 |
| Vendor | continew-org |
| Product | continew-admin |
| Published | Sep 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for continew-org continew-admin
Be the first to know when new medium vulnerabilities affecting continew-org continew-admin are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
continew-org / continew-admin
0 ≤ 4.1.0
References
github.com: https://github.com/continew-org/continew-admin/issues/220 github.com: https://github.com/continew-org/continew-admin github.com: https://github.com/continew-org/continew-admin/blob/v4.1.0/continew-system/src/main/java/top/continew/admin/system/controller/UserMessageController.java#L93-L97 github.com: https://github.com/continew-org/continew-admin/blob/v4.1.0/continew-system/src/main/java/top/continew/admin/system/service/impl/MessageServiceImpl.java#L130-L135 github.com: https://github.com/continew-org/continew-admin/commit/665ea2c757a3f1246db62fb139fec1aac3cca296 vulncheck.com: https://www.vulncheck.com/advisories/continew-admin-through-4.1.0-unauthorized-message-deletion-via-usermessagecontroller
Credits
🔍 George Chen