EdoWEB CVE-2026-16307

Exploitation requires an authenticated session on EdoWEB (CVSS PR:L - a valid low-privileged account), after which the attacker tampers with a user-controlled key to reach functionality or records that ACLs should restrict; the specific feature, parameter, or endpoint is not described in the available sources. Limiting factors: the attacker must first obtain valid credentials (no anonymous/unauthenticated path per PR:L), impact is confined to limited confidentiality (no data modification or service disruption per I:N/A:N), and exposure depends on the EdoWEB instance being network-reachable to the attacker. All versions before 780-g7 are affected; updating to 780-g7 is the vendor-provided fix.

This is a medium-severity authorization bypass (CWE-639, user-controlled key / IDOR) with a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The vector indicates a network-reachable, low-complexity attack that requires low-level privileges (PR:L) - i.e. an authenticated but unprivileged user - with no user interaction, and yields only limited confidentiality impact (C:L) with no integrity or availability impact. No EPSS probability is supplied, there is no CISA KEV listing, and no public exploit is identified, so none of the acute-urgency signals are present. The vuln.today decision label is 'this_month', which is consistent with a real-but-non-emergency issue: a genuine access-control flaw worth remediating on a normal patch cadence rather than an active-exploitation fire drill. The signals are internally consistent - there is no CVSS-versus-description conflict and no missing-vector problem - but exploitation-probability data (EPSS) is absent, so widespread versus targeted exploitation likelihood cannot be quantified from the input. Net: a legitimate access-control defect of limited blast radius, prioritized for routine monthly patching, not a drop-everything critical.

An authenticated low-privileged EdoWEB user manipulates a user-controlled key (such as an identifier in a request parameter) to reference records or functionality belonging to other users, accessing data the ACLs should have constrained. No public exploit code or PoC is identified, and the specific vulnerable parameter/endpoint is not described in the available sources. The limited confidentiality-only impact means the attacker reads or reaches unauthorized functionality but cannot (per CVSS) alter data or disrupt the service.