Costifier CVE-2026-15219

Exploitation requires a valid authenticated session on Costifier (CVSS PR:L), after which the attacker manipulates a user-controlled object identifier that the application trusts without verifying ownership. The specific limiting factor is the authentication requirement: an attacker must already possess low-privilege credentials, so this is not exploitable by fully anonymous remote users. No special non-default configuration is indicated in the description, and no user interaction is needed (UI:N). All versions of Costifier up to and including the 2026-10-16 build are affected; no patched version is confirmed because the vendor did not respond.

This is a moderate-severity authorization bypass (CWE-639, IDOR / Exploitation of Trusted Identifiers) rated CVSS 6.5. The provided vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N indicates network-reachable, low-complexity exploitation that requires an authenticated low-privileged account (PR:L) and no user interaction, with a pure integrity impact (I:H) and explicitly no confidentiality or availability impact (C:N/A:N). The real-world risk signals are weak-to-moderate: there is no CISA KEV listing and no POC referenced, so this is 'no public exploit identified at time of analysis' rather than active exploitation. No EPSS score and no SSVC decision data were supplied, so automatability and exploitation-maturity cannot be scored from the input. One notable inconsistency: for a user-controlled-key IDOR the typical outcome is unauthorized read (confidentiality), yet the vector sets C:N and I:H - this implies the flaw lets an authenticated user modify/overwrite records belonging to other tenants/users rather than read them; this should be verified with the vendor, though the vendor did not respond to disclosure. Overall this is a legitimate but not emergency-grade issue: it needs valid credentials and only affects integrity, so it is a prioritize-for-patching item, not a drop-everything vulnerability.

An authenticated low-privileged Costifier user intercepts or crafts an application request and substitutes another user's or tenant's object identifier (e.g., a record or cost-item ID) in a parameter. Because the application trusts the user-supplied identifier without an ownership check, the attacker modifies data belonging to another account. No public exploit code was identified, and exploitation requires valid credentials but no user interaction or elevated privileges.