CVE-2026-14850
Description
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership.
Is your site exposed to CVE-2026-14850?
Run a free security scan — no signup, results in seconds.
Weakness Type (CWE)
References
Frequently Asked Questions
What is CVE-2026-14850? +
How do I check if I'm vulnerable to CVE-2026-14850? +
Related Vulnerabilities
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a `ClientPasswordReset` record already …
Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server …
Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes (email/registration validation, password reset, and persistent login) in a …
A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. …
This vulnerability exists in the CAP back office application due to a weak password-reset mechanism implemented at API endpoints. An …
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, …