CVE-2026-79989

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An issue exists where any authenticated user can change their own password without providing the current password or possessing an active elevated session. Additionally, an attacker can change passwords of other users if their account has the Edit users permission but lacks the Administrate users permission, bypassing the requirement for the latter to perform such actions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.