CVE-2026-92603

ContiNew Admin through 4.1.0 contains an authorization bypass in the personal message delete endpoint (UserMessageController). The vulnerable code fails to validate message ownership when processing the IdsReq parameter, allowing any authenticated user to supply arbitrary message identifiers to d...