LOWVulnerability
CVE-2026-77146
The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is only present in the 8.x versions of the extension.
Properties
- last_source
- NVD
- cve_id
- CVE-2026-77146
- signal_observed_at
- 2026-09-29T00:56:27+00:00
- retrieved_at
- 2026-09-29T00:56:27+00:00
- published_at
- 2026-08-25T09:17:35.820
- last_modified
- 2026-09-28T23:10:00.143
Related Entities (2)
HAS_WEAKNESS (1)
→[Weakness]Missing Authorization
DESCRIBED_BY (1)
→[Source]NVD
Explore deeper with Ninja Signal's threat intelligence graph