CVE-2026-44961
Received Received - Intake
XML-RPC API addUser Method Validation Bypass

Publication date: 2026-06-23

Last updated on: 2026-06-23

Assigner: HackerOne

Description
The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129. As a result, API users could create usernames that enabled impersonation or stored XSS attacks. Proper validation has been added where it was missing.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-23
Last Modified
2026-06-23
Generated
2026-06-23
AI Q&A
2026-06-23
EPSS Evaluated
N/A
NVD
CVE-2026-44961
EUVD
EUVD-2026-38504
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the XML-RPC API addUser method, where a validation bypass was introduced in a previous fix (CVE-2025-55129). Because of this bypass, API users could create usernames that allow impersonation or stored cross-site scripting (XSS) attacks. The issue was due to missing proper validation, which has now been added.

Impact Analysis

The vulnerability could allow attackers to create usernames that impersonate other users or inject stored XSS attacks. This could lead to unauthorized actions performed under another user's identity or the execution of malicious scripts in the context of the application, potentially compromising user data or application integrity.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44961. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart