What is the CVSS score of CVE-2026-32391?

CVE-2026-32391 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Smartfix are affected by CVE-2026-32391?

Organizations using Missing Authorization vulnerability in linethemes SmartFix smartfix should be aware of moderate risk from CVE-2026-32391, a missing authorization vulnerability rated CVSS 5.4.. A patch is available.

How to fix or mitigate CVE-2026-32391?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Smartfix CVE-2026-32391

EUVD-2026-11901 MEDIUM

Missing Authorization (CWE-862)

2026-03-13 Patchstack

Authentication Bypass Smartfix

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.2.4

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11901

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 5.4

DescriptionCVE.org

Missing Authorization vulnerability in linethemes SmartFix smartfix allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartFix: from n/a through < 1.2.4.

AnalysisAI

SmartFix by linethemes contains a missing authorization vulnerability (CWE-862) that allows authenticated users to access or modify resources they should not have permission to access due to incorrectly configured access control security levels. Affected versions are SmartFix prior to 1.2.4. An attacker with low-privilege credentials can exploit this network-accessible vulnerability without user interaction to gain unauthorized access to sensitive data or perform unauthorized modifications.

Technical ContextAI

The vulnerability stems from improper implementation of access control checks in SmartFix, classified under CWE-862 (Missing Authorization). The root cause is that the application fails to properly validate user permissions before granting access to sensitive operations or data resources. This is a common flaw in web applications and software platforms where authorization decisions are not consistently applied across all endpoints or functions. The SmartFix product (linethemes CPE context: cpe:2.3:a:linethemes:smartfix) implements configurable access control security levels, but the configuration validation or enforcement mechanism is flawed, allowing attackers to bypass intended restrictions through normal API or UI interactions.

RemediationAI

Immediately upgrade SmartFix to version 1.2.4 or later, which contains fixes for the incorrectly configured access control security levels. Verify the upgrade process in the linethemes official release notes and security advisory. As a temporary mitigation before patching, restrict network access to SmartFix instances to trusted IP ranges or authorized users only, implement multi-factor authentication to reduce the risk of compromised low-privilege accounts, and monitor access logs for suspicious authorization-related activity (repeated access attempts to unauthorized resources). Apply the patch at your earliest maintenance window, as authorization flaws are high-priority security issues.