CVE-2026-44961
The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129. As a result, API users could create usernames that enabled impersonation or stor…
Published: 2026-06-23 · CVSS: 0.0 · CVSS 3.0
The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129. As a result, API users could create usernames that enabled impersonation or stored XSS attacks. Proper validation has been added where it was missing.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7