Executive brief
ContiNew Admin is a multi-tenant backend management framework used to power administrative dashboards and user communication features. The vulnerability allows authenticated users to delete other users' personal messages and announcements by manipulating message identifiers, disrupting communication workflows and potentially erasing important records across the organization.
Technical details
The vulnerability is an authorization bypass in the personal message deletion endpoint (/delete) of the UserMessageController. The affected code fails to validate message ownership before processing deletion requests; attackers can supply arbitrary message IDs in the IdsReq parameter to delete any message row and purge all recipients' read receipts without ownership checks. Authentication is required to exploit this flaw, but no additional preconditions are present. The vulnerability affects ContiNew Admin through version 4.1.0 and permits an authenticated user to destructively remove any message from the system. Patched versions beyond 4.1.0 should be available from the vendor's repository.
Affected products
- ContiNew Admin through 4.1.0
Timeline
- 2026-09-16: disclosed