Tag: Account Takeover (1 posts)

CVE-2026-54840 - Newsletters Unauthenticated Subscriber Management Account Takeover

Broken access control in Newsletters <= 4.13 lets an unauthenticated attacker take over any subscriber's management account via a predictable md5(id) token.