Description An improper access check allows unauthorized users to create custom fields via webservices endpoints. Remediation References CVE-2026-48958 Related Vulnerabilities Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-23921) Gunicorn Improper Neutralization of CRLF Sequences ('CRLF Injection') Vulnerability (CVE-2018-1000164) WordPress Plugin U BuddyPress Forum Attachment 'fileurl' Parameter Remote File Disclosure (1.1.1) WordPress Plugin Better Search Replace Multiple Unspecified Vulnerabilities (1.0.3) Grafana Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Vulnerability (CVE-2022-39328) Severity High Classification CVE-2026-48958 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Tags Missing Update Known Vulnerabilities