CVE-2026-46721 — The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitra — CVE Database · The Intelligence Room