CVE-2026-14949: CWE-863 Incorrect Authorization in Frauscher Sensortechnik FDS 102

CVE-2026-14949 is a CWE-863 Incorrect Authorization vulnerability in Frauscher Sensortechnik FDS 102. An attacker with a valid low-privilege session can exploit the user creation API endpoint (/api/user/add.php) to create new user accounts with arbitrary role values, including administrative privileges. This allows privilege escalation within the application. The vulnerability affects versions >=2.11.0 and <=2.13.3. No known exploits are reported in the wild. The CVSS 4.0 score is 8.5, reflecting network attack vector, low complexity, no user interaction, and high impact on integrity and availability.

An attacker with a valid low-privilege session can escalate privileges by creating new accounts with arbitrary roles, including the highest privilege level. This could lead to unauthorized administrative access, potentially compromising the confidentiality, integrity, and availability of the system.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the user creation API endpoint to trusted users only and monitor for suspicious account creation activity.