Security Resilience

CVE-2026-14949

Access Control

Access Control
Published
20 August 2026
Modified
03 September 2026
CVSS Score v4 8.5
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0037 30th percentile
Risk Priority 38 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-14949 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Certvde (inferred from references). Its CVSS base score is 8.5 (High).

Operationally, ranked at the 30th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-25 (Reference Monitor) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application.

CWE(s)
CWE-863

Related Threats

CVEs Like This One

CVE-2023-27485Shared CWE-863
CVE-2024-50650Shared CWE-863
CVE-2026-87075Shared CWE-863
CVE-2023-25924Shared CWE-863
CVE-2026-62683Shared CWE-863
CVE-2025-14866Shared CWE-863
CVE-2024-39871Shared CWE-863
CVE-2023-50457Shared CWE-863
CVE-2025-30743Shared CWE-863
CVE-2019-7304Shared CWE-863

Affected Assets

Certvde
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5)

Our mappings, made for this CVE.

AC-3 Access Enforcement good match

AC-3 directly requires correct enforcement of authorization decisions on every access request, structurally preventing incorrect checks.

AC-24 Access Control Decisions good match

AC-24 ensures access-control decisions are made and applied consistently, reducing the chance of an incorrect authorization result.

AC-25 Reference Monitor good match

A reference monitor that is always invoked and tamper-proof forces every authorization decision through a verified, correct path.

AC-6 Least Privilege partial match

Least-privilege assignments shrink the set of authorizations that must be checked correctly, limiting exposure to flawed checks.

Mitigating Controls (ISO/IEC 27001:2022 Annex A)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.

A.8.3 Information access restriction full match
blocks

A.8.3's access restriction mechanisms, including granular per-user and per-identity controls, directly enforce correct authorization checks, preventing exploitation of incorrect authorization flaws.

A.5.15 Access control partial match
blocks

Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-863, a class-level weakness, and none of its children carries one either.

References