Which versions of ContiNew Admin are affected by CVE-2026-92603?

ContiNew Admin versions through 4.1.0 contain a high-severity authorization flaw that lets any user with a valid, non-privileged account delete other employees' personal messages and announcements,…. A patch is available.

How to fix or mitigate CVE-2026-92603?

Within 24 hours, inventory all ContiNew Admin deployments and flag every instance running version 4.1.0 or earlier, then upgrade them to the fixed release referenced in the vendor advisory (a vendor patch is available); where an immediate upgrade is not feasible, temporarily restrict message and announcement deletion capability to a small, trusted administrative group and export current message and read-receipt data so that any deletions can be reconstructed. Within 7 days, complete the upgrade on all remaining instances including staging and test environments, and review deletion activity and database backups for unexplained bulk removals of personal messages, announcements, or read receipts since 4.1.0 was deployed. Within 30 days, verify the fix with a controlled test using a low-privileged account, add server-side ownership validation requirements to the design and code-review standards for any custom message endpoints, extend monitoring and alerting to detect anomalous bulk-deletion patterns originating from ordinary accounts, and incorporate authorization testing of messaging and announcement APIs into routine patch and change-management cycles.

ContiNew Admin CVE-2026-92603

Q: What is the CVSS score of CVE-2026-92603?

CVE-2026-92603 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-80861 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-09-16 VulnCheck

GHSA-8qc6-4wmj-p8f9

Authentication Bypass Continew Admin

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Any authenticated user (PR:L) can remotely and easily (AV:N/AC:L) delete other users' data, giving high integrity impact but no confidentiality; deletion is scored as integrity tampering, not availability of the whole system.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 16, 2026 - 16:55 vuln.today

CVE Published

Sep 16, 2026 - 16:03 cve.org

HIGH 7.1

DescriptionCVE.org

ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users' messages and announcements. Attackers can supply arbitrary message identifiers in the IdsReq parameter to remove any message row and purge all recipients' read receipts without ownership validation.

AnalysisAI

Authorization bypass in ContiNew Admin through 4.1.0 allows any authenticated user to delete other users' personal messages and announcements by submitting arbitrary identifiers in the IdsReq parameter to the personal message delete endpoint in UserMessageController. Because the pre-patch MessageServiceImpl.delete() called baseMapper.deleteByIds(ids) without verifying ownership, the attacker can remove any message row and also purge all recipients' read receipts for those messages. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an authenticated session on the target ContiNew Admin instance (PR:L) - any valid user account suffices; no admin role is needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine but moderate-severity authorization/IDOR flaw (CWE-639), not a critical one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upstream fix available (commit 665ea2c757a3f1246db62fb139fec1aac3cca296, https://github.com/continew-org/continew-admin/commit/665ea2c757a3f1246db62fb139fec1aac3cca296); a specific tagged release version containing the fix is not independently confirmed from the supplied data, so operators should either build from this commit or from the first release published after it, and should verify the fix by confirming MessageService.delete now accepts a userId argument and filters on NoticeScopeEnum.ALL or USER-scope membership. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all ContiNew Admin deployments and flag every instance running version 4.1.0 or earlier, then upgrade them to the fixed release referenced in the vendor advisory (a vendor patch is available); where an immediate upgrade is not feasible, temporarily restrict message and announcement deletion capability to a small, trusted administrative group and export current message and read-receipt data so that any deletions can be reconstructed. …

Threat intelligence, references, and detailed analysis are available after sign-in.