Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the deleteUserAccount JSON-RPC method that permits any authenticated low-privileged user (UG_USER) to delete arbitrary user accounts, except for the built-in admin account. The application does not enforce role-based access control on this function, allowing a standard user to submit a crafted POST request to /jsonrpc/management specifying another username to have that account removed without elevated permissions or additional confirmation.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 1 product
| Date | Total | Labels |
|---|
| 2026-02-15 | 2 | Disclosure2 |
| 2026-02-16 | 1 | Disclosure1 |
CVE-2026-26367 Unauthorized User Account Deletion in eNet SMART HOME Server 2.2.1 and 2.3.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26367
Post summary
The post discloses CVE-2026-26367, detailing an unauthorized user account deletion vulnerability in specific eNet SMART HOME Server versions, with no evidence of PoC, exploit, patch, or active exploitation.
CVE-2026-26367 eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the deleteUserAccount JSON-RPC method that permits any authenticated low-priv… https://www.cve.org/CVERecord?id=CVE-2026-26367
Post summary
CVE-2026-26367 reveals a missing authorization flaw in eNet SMART HOME server’s deleteUserAccount JSON‑RPC method, enabling authenticated low‑privileged users to delete accounts.
🚨 HIGH severity: JUNG eNet SMART HOME server (2.2.1 & 2.3.1) flaw lets any user delete accounts via missing authorization. Limit access & monitor accounts ASAP! https://radar.offseq.com/threat/cve-2026-26367-missing-authorization-in-jung-enet--173718f4 #OffSeq #SmartHome #Vuln... https://t.co/GRLRx6EU0w
Post summary
The tweet announces a high‑severity missing‑authorization flaw in JUNG eNet SMART HOME server that lets users delete accounts, urging administrators to restrict access and monitor accounts.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jung-group | enet_smart_home | 2.2.1 | - | - |
| App | jung-group | enet_smart_home | 2.3.1 | - | - |