CyberRota Analysis
This is a high severity vulnerability with a CVSS score of 8.1. See the original NVD description below for full technical details.
CVE
CVE-2026-26367
Severity
HIGH
CVSS
8.1
EPSS
0.37%
Original NVD Description
eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the deleteUserAccount JSON-RPC method that permits any authenticated low-privileged user (UG_USER) to delete arbitrary user accounts, except for the built-in admin account. The application does not enforce role-based access control on this function, allowing a standard user to submit a crafted POST request to /jsonrpc/management specifying another username to have that account removed without elevated permissions or additional confirmation.
Related CVEs
Other vulnerabilities affecting the same vendor(s)