CVE-2026-14949 is a vulnerability where a low privileged remote attacker who has a valid session can submit requests to the user creation API endpoint (/api/user/add.php) to create new accounts with arbitrary role values. This includes the ability to assign the highest privilege level used by the application, effectively allowing privilege escalation. The vulnerability is classified under CWE-863 (Incorrect Authorization). The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker with a valid session but low privileges can escalate their privileges by creating new user accounts with elevated roles, potentially gaining administrative or highest-level access within the application. This compromises the integrity of the system by allowing unauthorized privilege escalation. There is no reported impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the user creation API endpoint and monitor for suspicious activity involving account creation with elevated roles.