bizwell xClick CVE-2026-88262

Exploitation requires that the attacker first acquire a valid xClick session token from a targeted user on an affected version (R2, R3, or R3.1). Token acquisition is out-of-band and not part of the vulnerability itself - viable methods include network traffic interception on a shared segment, physical access to the victim's browser or device, or a chained exfiltration technique such as cross-site scripting. The UI:P condition in the CVSS 4.0 vector confirms that the victim must have authenticated to xClick, generating a session token, before exploitation is possible. The core vulnerability activates at the moment the user logs out or the expected session lifetime passes - at which point the token should be invalidated server-side but is not. The attacker does not need any xClick credentials of their own (PR:N). Exploitation is bounded to environments running xClick R2, R3, or R3.1; no special network position is required after token acquisition.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) reflects a network-reachable, low-complexity attack requiring only passive victim interaction - the target must have authenticated to xClick to generate a reusable token. The high impact across all three CIA dimensions aligns with full account takeover potential in a groupware environment, where sessions grant access to internal communications, documents, and calendar data. However, the base score overstates real-world exploitability: it does not account for the out-of-band prerequisite of first acquiring the target's session token, which requires network interception, physical device access, or a chained secondary vulnerability. EPSS data is absent from the available intelligence, and no CISA KEV listing exists, reinforcing that exploitation is not currently observed at scale. Even a mid-sized municipal IT team in bytom running xClick internally should treat this as a prompt remediation priority given the account-takeover severity, but the niche, regionally concentrated deployment footprint of this Korean groupware product limits ecosystem-wide risk materially.

An attacker on a shared or monitored network segment captures a xClick user's session cookie via passive traffic interception or via access to the user's device or browser storage. After the legitimate user logs out, the attacker replays the captured token directly to the xClick application, which accepts it without verifying whether the session was invalidated, and grants full access to the impersonated account. No public exploit code has been identified at time of analysis, but the technique requires no specialized tooling beyond standard HTTP request manipulation.