BankPro Service Center CVE-2026-9493

Attacker must hold a valid authenticated session on the Service Center application (PR:L in the CVSS vector), which in practice means any legitimate customer or staff login - including self-registered accounts where registration is open. The attacker must be able to reach the application over the network (AV:N) and invoke the specific EC order query function whose identifier parameter is not server-side authorized. No user interaction by the victim is required (UI:N), no elevated privileges are needed, and no non-default configuration is required - the vulnerability is in the query function itself. Exploitation is limited to confidentiality of EC order details (VC:H, VI:N, VA:N): the attacker can read but not modify or delete victim records via this flaw, and impact does not extend beyond the Service Center application (SC:N).

Risk is moderate-to-high for affected deployments. The CVSS 4.0 base score of 7.1 with AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N is consistent with an easily-exercised, network-reachable IDOR that breaches confidentiality only - no integrity or availability impact, and no scope change to other components. There is no CISA KEV listing (BankPro is a Taiwan-regional product unlikely to appear in KEV regardless of exploitation), no EPSS score visible in the provided data, and no public exploit identified at time of analysis. However, IDORs of this class are trivially automatable once an attacker has any low-privileged account (e.g., self-registration or a single compromised customer credential), and the leaked data - EC order details - is sensitive PII/financial information that carries regulatory exposure under Taiwan's Personal Data Protection Act and PCI-DSS for any payment fields. EPSS and POC status are missing from the input, so likelihood of opportunistic exploitation cannot be quantitatively assessed; treat as a priority for institutions in the BankPro install base, lower priority elsewhere.

An attacker registers or compromises any low-privileged Service Center customer account, logs in, and invokes the vulnerable EC order query function while substituting another customer's order or user identifier in the request parameter; the server returns that victim's order details without an ownership check. Iterating the identifier across a numeric range yields bulk extraction of other customers' EC purchase history - a realistic precursor to fraud, phishing, or regulatory breach disclosure. No public exploit is identified at time of analysis, but the technique is well-understood and easily scripted with common HTTP tooling.