FlexCity CVE-2026-8285

The CVSS PR:L metric confirms that the attacker must already hold a low-privileged account within FlexCity-unauthenticated exploitation is not indicated by the provided vector. Attack complexity is low (AC:L) and no user interaction is required (UI:N), meaning any credentialed user can exploit this without special timing or target interaction. No non-default configuration flag or specific feature-enablement condition is stated in the description as a prerequisite. Impact is limited to partial availability degradation (A:L) against FlexCity versions 5.536.0 through 11052026 specifically. The additional 'Information Disclosure' impact (username enumeration) remains unconfirmed from available data and should be validated against the vendor advisory before treating it as an established exploitation condition.

The NVD CVSS score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L characterizes this as a moderate, low-complexity network flaw limited to partial availability impact. No EPSS data was provided, so quantitative exploitation probability cannot be assessed. The vulnerability is absent from CISA KEV, and no public proof-of-concept code is known-indicating no confirmed active exploitation. The PR:L requirement meaningfully constrains the attacker pool to those already holding valid FlexCity credentials. The availability impact (A:L) is bounded to service degradation rather than full outage. The 'Information Disclosure' tag directly conflicts with C:N in the CVSS vector; if username enumeration is achievable, the effective confidentiality risk is higher than the score reflects and defenders should treat this as an open question requiring vendor clarification. Overall, this is a real but operationally moderate finding-not an emergency-priority patch unless the information-disclosure dimension is confirmed or the environment relies on FlexCity for critical municipal operations.

A low-privileged FlexCity user-or an attacker who has obtained any valid credential through prior means-scripted repeated authentication requests against the application over the network, bypassing the absent rate-limiting controls to exhaust server-side session or memory allocations and degrade service responsiveness for concurrent legitimate users. If the information-disclosure behavior is present, the same attacker can probe authentication responses to enumerate valid account names before or alongside the resource-exhaustion effort. No public exploit code has been identified at time of analysis.