Vulnerabilities

TI-2026-62459 CVE-2026-92603 · GHSA-8qc6-4wmj-p8f9

ContiNew Admin through 4.1.0 Unauthorized Message Deletion via UserMessageController

MEDIUM 64

ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users' messages and announcements.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00467 Published 2026-09-16 No fix listed CWE-639

TI-2026-55333 CVE-2026-80050 · GHSA-4wpm-f9xp-x65x

ContiNew Admin through 4.1.0 Missing Authorization and File-Type Allowlist on Multipart Upload Endpoints

MEDIUM 64

ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.003 Published 2026-08-25 No fix listed CWE-434

Vulnerabilities

Filters

ContiNew Admin through 4.1.0 Unauthorized Message Deletion via UserMessageController

ContiNew Admin through 4.1.0 Missing Authorization and File-Type Allowlist on Multipart Upload Endpoints