MobiAPParc CVE-2026-14850

No special conditions beyond reaching the application: exploitation targets the password-recovery/forgotten-password feature of MobiAPParc and abuses a predictable, sequential numeric user_id that is not bound to a proof of account ownership, so a remote unauthenticated attacker on default configurations can reset arbitrary accounts. Limiting factors are practical rather than access-based: the attacker must be able to reach the MobiAPParc instance over the network and the target must be running an affected version (≤2.28 or ≤2.42 per EUVD); real-world blast radius is constrained mainly by the product's limited deployment rather than by any required user interaction, privilege, or non-default setting.

Real-world risk is elevated on paper (CVSS 4.0 base 8.8) but must be read carefully. The signals that are present all point the same direction: the vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, fully unauthenticated flaw, and the mechanic - an Insecure Direct Object Reference on a predictable numeric user_id in the password-reset flow (CWE-640) - is trivially automatable, so an attacker can iterate identifiers to compromise arbitrary accounts. However, several risk-amplifying signals are ABSENT rather than negative: there is no EPSS probability supplied, no CISA KEV listing, and no public POC referenced - status is 'no public exploit identified at time of analysis.' The one conflict worth flagging is impact scope: the vendor rated confidentiality only VC:L while integrity/availability are VI:H/VA:H, which implies the reset locks victims out or forces a new (possibly emailed) credential rather than handing the attacker a chosen password; if instead the attacker sets the new password directly this is a full account takeover and confidentiality should be H - verify the exact reset mechanic with the vendor/INCIBE advisory. Net: a genuine, easily-exploitable authorization flaw and a legitimate patch-now item for any operator running MobiAPParc, but its aggregate internet-wide risk is bounded by the product's small deployment footprint rather than by exploit difficulty.

An unauthenticated attacker opens the MobiAPParc forgotten-password flow, intercepts the reset request, and swaps their own predictable numeric user_id for a victim's. Because ownership is never verified, the server processes the password reset against the victim account, letting the attacker lock out or take over arbitrary users by simply enumerating sequential IDs. No public exploit code is referenced, but the technique is manual-interception-simple and requires no special tooling.