CVE-2026-38470

A broken access control vulnerability exists in the API user endpoint of GazellePW (GazellePosterWall) , specifically within commit 86c4bedf727691b5a97af42a4864869d18446449. This flaw allows unprivileged, authenticated users to enable or disable arbitrary user accounts by using the req=disable or...