ContiNew Admin CVE-2026-92603

Requires an authenticated session on the target ContiNew Admin instance (PR:L) - any valid user account suffices; no admin role is needed. The attacker must reach the personal message delete endpoint in UserMessageController and supply arbitrary message IDs in the IdsReq parameter; the pre-patch MessageServiceImpl.delete() called baseMapper.deleteByIds(ids) with no ownership validation. Exploitation is limited only by the need for valid credentials and by running a version through 4.1.0; the fixed version filters deletions to messages the caller actually received (NoticeScopeEnum.ALL or USER-scoped containing the user's ID). No user interaction, no non-default configuration, and no special platform is required.

This is a genuine but moderate-severity authorization/IDOR flaw (CWE-639), not a critical one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) is internally consistent with the description: any authenticated user can delete arbitrary messages, giving high integrity impact but no confidentiality or availability impact and no scope change. All signals point to lower real-world urgency: no CISA KEV listing, no public POC identified, and no EPSS score provided. The vulnerability requires valid authentication (PR:L), which meaningfully limits the attacker population to existing users of a given deployment. There are no conflicting signals - the vendor CVSS, the CWE-639 mapping, and the source-code diff (which adds an ownership check messageService.delete(req.getIds(), UserContextHolder.getUserId()) filtering to messages the user actually received) all corroborate an authenticated horizontal-privilege IDOR. Note the input Tag 'Authentication Bypass' is imprecise: this is an authorization (access-control) bypass, not an authentication bypass. Overall: a real integrity/data-destruction bug worth patching, but low probability of widespread automated exploitation.

A registered low-privilege user of a ContiNew Admin instance logs in, observes the message-delete endpoint, and submits a request containing message IDs they do not own in the IdsReq parameter. The server deletes those rows and purges all recipients' read receipts without validating ownership, letting the attacker destroy other users' personal messages and system announcements. No public exploit code is identified at time of analysis, but exploitation is trivial (AC:L) for anyone with an account.