Unauthorized Account Modification in MobiAppARC due to Insecure Password Reset Functionality
CVE-2026-14850

8.8HIGH

Key Information:

Vendor

Mobiapparc

Status
Mobiapparc
Vendor
CVE Published:
17 September 2026

What is CVE-2026-14850?

The password reset mechanism in MobiAppARC exhibits a security flaw where the user_id parameter is not properly validated. This allows attackers to exploit this oversight, enabling them to reset passwords for any user account without the need for legitimate account verification. By manipulating the easily guessable numeric user_id, unauthorized users can gain access to accounts, risking personal data and security. It is crucial for users and administrators to be aware of this vulnerability and apply necessary patches to safeguard against potential exploitation.

Affected Version(s)

MobiAPParc 0 <= 2.28

MobiAPParc 0 <= 2.42

References

https://www.incibe.es/en/incibe-cert/notices/aviso/weak-p...
patch

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Llorenç Romá
.