Improper access control in Simple User Management - CVE-2026-114543
Published: October 23, 2026
Vulnerability identifier: #VU157404
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-114543
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the affected module does not sufficiently check role delegation when approving users, and offers an Activate link for blocked administrators. A remote user can activate blocked administrative accounts and deactivate or delete the user 1.
Affected software
Simple User Management
How to mitigate CVE-2026-114543
Install updates from vendor's website.
Simple User Management - update to 1.11.0