CVE-2026-26367highCWE-862

CVE-2026-26367: high-severity vulnerability in JUNG eNet SMART HOME server

JUNG eNet SMART HOME server 2.2.1/2.3.1 Arbitrary User Deletion via deleteUserAccount

Published · Updated

Follow this CVE+ Monitor eNet SMART HOME server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.4%
In short

A flaw in JUNG eNet SMART HOME server allows any regular user to delete other users' accounts by sending a specially crafted request. This is dangerous because it lets low-level users damage other accounts and disrupt system access for legitimate users.

Technical detail

The deleteUserAccount JSON-RPC method at /jsonrpc/management endpoint lacks proper authorization checks (CWE-862), allowing authenticated users with basic privileges (UG_USER) to delete arbitrary accounts via POST requests with crafted parameters. The vulnerability affects versions 2.2.1 and 2.3.1, with the admin account excluded from deletion.

Summary generated and translated by AI from the official description.
eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the deleteUserAccount JSON-RPC method that permits any authenticated low-privileged user (UG_USER) to delete arbitrary user accounts, except for the built-in admin account. The application does not enforce role-based access control on this function, allowing a standard user to submit a crafted POST request to /jsonrpc/management specifying another username to have that account removed without elevated permissions or additional confirmation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
JUNG · eNet SMART HOME server
Related CVEs — JUNG eNet SMART HOME server

In the same product, most dangerous first.

CVE-2026-26366CRITICALJUNG eNet SMART HOME server 2.2.1/2.3.1 Use of Default CredentialsEPSS 0.7%CVE-2026-26369HIGHJUNG eNet SMART HOME server 2.2.1/2.3.1 Privilege Escalation via setUserGroupEPSS 0.6%CVE-2026-26368HIGHJUNG eNet SMART HOME server 2.2.1/2.3.1 Account Takeover via resetUserPasswordEPSS 0.6%