CVE-2026-14850 — Weak password recovery mechanism for forgotten password in MobiAPParc

CVE-2026-14850

Weak password recovery mechanism for forgotten password in MobiAPParc PUBLISHED

Description (CNA)

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership.

Affected (CNA)

Vendor / product	Versions
MobiAPParc / MobiAPParc	affected 0 through 2.28; affected 0 through 2.42

CWE

CWE-640

References

https://www.incibe.es/en/incibe-cert/notices/aviso/weak-password-recovery-mechanism-forgotten-password-mobiapparc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.