None severity0.0NVD Advisory· Published Jun 23, 2026· Updated Jun 25, 2026

CVE-2026-44961

Description

The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129. As a result, API users could create usernames that enabled impersonation or stored XSS attacks. Proper validation has been added where it was missing.

Patches

Vulnerability mechanics

References

hackerone.com/reports/3680090nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000