CVE-2026-118567

Name of the Vulnerable Software and Affected Versions Bulk Update User Roles versions 0.0.0 through 1.0.5

Description An incorrect authorization issue allows forceful browsing, where users without the required permissions can access the bulk update form used for assigning or removing roles on multiple user accounts. This is mitigated by the requirement that an attacker must already possess a role with the "administer users" permission.

Recommendations Update Bulk Update User Roles to a version later than 1.0.5.