CVE-2026-26367 - JUNG eNet SMART HOME server 2.2.1/2.3.1 Arbitrary User Deletion via deleteUserAc...

CVE ID : CVE-2026-26367 Published : Feb. 15, 2026, 4:15 p.m. | 15 minutes ago Description : eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the deleteUserAccount JSON-RPC method that permits any authenticated low-privileged user (UG_USER) to delete arbitrary user accounts, except for the built-in admin account. The application does not enforce role-based access control on this function, allowing a standard user to submit a crafted POST request to /jsonrpc/management specifying another username to have that account removed without elevated permissions or additional confirmation. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...