Authorization Bypass in ContiNew Admin for Message Deletion by Authenticated Users

CVE-2026-92603

What is CVE-2026-92603?

The ContiNew Admin software enables authenticated users to exploit an authorization bypass vulnerability found in the personal message delete endpoint. This issue permits users to delete messages and announcements belonging to other users without proper validation, resulting in unauthorized access to message management. By supplying arbitrary message identifiers in the IdsReq parameter, attackers can indiscriminately remove any message and eliminate recipients' read receipts, raising serious concerns regarding user privacy and data integrity.

References