High severity8.1NVD Advisory· Published Feb 15, 2026· Updated Jun 17, 2026
CVE-2026-26367
CVE-2026-26367
Description
eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the deleteUserAccount JSON-RPC method that permits any authenticated low-privileged user (UG_USER) to delete arbitrary user accounts, except for the built-in admin account. The application does not enforce role-based access control on this function, allowing a standard user to submit a crafted POST request to /jsonrpc/management specifying another username to have that account removed without elevated permissions or additional confirmation.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5cpe:2.3:a:jung-group:enet_smart_home:2.2.1:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:jung-group:enet_smart_home:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:jung-group:enet_smart_home:2.3.1:*:*:*:*:*:*:*
2.2.1, 2.3.1+ 1 more
- (no CPE)range: 2.2.1, 2.3.1
- (no CPE)range: 2.2.1, 2.3.1
- Range: 2.3.1 (46841)
Patches
Vulnerability mechanics
References
2- www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5973.phpnvdExploitThird Party Advisory
- www.vulncheck.com/advisories/jung-enet-smart-home-server-arbitrary-user-deletionvdBroken Link
News mentions
0No linked articles in our index yet.