What is CVE-2026-92603?

CVE-2026-92603 is a medium-severity vulnerability in Continew-Org Continew-Admin, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2026-09-16.

How severe is CVE-2026-92603?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Continew-Org Continew-Admin

CVE-2026-92603

ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users' messages and announcements. Attackers can supply arbitrary message identifiers in the IdsReq parameter to remove any message row and purge all recipients' read receipts without ownership validation.

Vulnerability class: IDOR (Insecure Direct Object Reference)

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Continew-org Continew-admin

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-92603?: CVE-2026-92603 is a medium-severity vulnerability in Continew-Org Continew-Admin, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2026-09-16.
How severe is CVE-2026-92603?: Medium severity. CVSS v3 base score is 6.5 out of 10.