CVE-2026-92603

ContiNew Admin through 4.1.0 contains an authorization bypass (CWE-639) in its personal message delete endpoint: the server fails to verify that the requesting user owns the targeted message rows. An authenticated low-privileged user can supply arbitrary message identifiers in the IdsReq parameter to delete any other user's messages and announcements, and to purge all recipients' read receipts in a single request. The impact is a loss of message integrity (high integrity per the CVSS 4.0 score of 7.1) rather than confidentiality or availability. Any deployment of ContiNew Admin up to and including 4.1.0 that exposes the messaging module to ordinary authenticated accounts is affected. No public proof-of-concept is known, the issue is not listed in CISA KEV, and no exploitation has been reported.

What to do: Upgrade to a ContiNew Admin release newer than 4.1.0 once the vendor publishes a patched build, as no fixed version is confirmed in the current data. As an interim mitigation, restrict the message-delete endpoint to administrative roles and enforce server-side ownership validation of message IDs. Audit application logs for delete requests where the IdsReq identifiers reference messages owned by other users.