XML-RPC API addUser Method Validation Bypass

Publication date: 2026-06-23

Last updated on: 2026-06-25

Assigner: HackerOne

Description

The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129. As a result, API users could create usernames that enabled impersonation or stored XSS attacks. Proper validation has been added where it was missing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-23

Last Modified

2026-06-25

Generated

2026-07-14

AI Q&A

2026-06-23

EPSS Evaluated

2026-07-12

NVD

CVE-2026-44961

EUVD

EUVD-2026-38504

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the XML-RPC API addUser method, where a validation bypass was introduced in a previous fix (CVE-2025-55129). Because of this bypass, API users could create usernames that allow impersonation or stored cross-site scripting (XSS) attacks. The issue was due to missing proper validation, which has now been added.

Impact Analysis

The vulnerability could allow attackers to create usernames that impersonate other users or inject stored XSS attacks. This could lead to unauthorized actions performed under another user's identity or the execution of malicious scripts in the context of the application, potentially compromising user data or application integrity.

Hi! I’m here to help you understand CVE-2026-44961. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70