Pizzy Library EUVD-2026-36717

The attacker must (1) hold valid credentials for at least a low-privilege account on the application using Pizzy Library (PR:L), (2) have network reachability to the library's exposed interface (AV:N), and (3) interact with the specific feature governed by the 'incorrectly configured access control security levels' described by the vendor - i.e., an operation whose authorization decision depends on the misconfigured security-level check. No user interaction from a victim is required (UI:N), and attack complexity is low (AC:L), so no race condition or non-default environment is needed. Exploitation is LIMITED to deployments running Pizzy Library versions 1.0.0.26250 through 1.3.9.26250 (exclusive) where the vulnerable access-controlled functionality is actually invoked and the attacker possesses a usable authenticated session; purely anonymous remote exploitation against default configurations is not supported by the CVSS vector.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) describes a network-reachable, low-complexity flaw that requires low-privilege authentication and no user interaction, with high confidentiality impact, low integrity impact, and no availability impact - consistent with an authorization bypass that primarily exposes data. There is no CISA KEV listing, no EPSS score, and no SSVC decision recorded in the input, and no public exploit identified at time of analysis, so the immediate threat is lower than the 7.1 score alone would suggest. The 'Authentication Bypass' tag is in tension with the PR:L metric: PR:L implies the attacker must already hold some account, so the bypass is more accurately a privilege/authorization bypass rather than a pre-auth bypass - defenders should verify which interpretation applies before prioritizing. Real-world risk depends heavily on whether the Pizzy Library is exposed to multi-tenant or low-trust authenticated users; in single-tenant or internal-only deployments the practical exposure is materially lower.

An attacker who has obtained any low-privilege account on an application embedding Pizzy Library authenticates normally and then issues a request to a resource or action whose authorization is governed by the misconfigured security level. Because the library does not properly enforce the intended tier separation, the request returns sensitive data belonging to higher-privileged users or tenants, yielding the high-confidentiality and low-integrity outcomes reflected in the CVSS vector. No public exploit identified at time of analysis, but the AC:L rating suggests a working request requires no special timing, race conditions, or environmental preparation once an account is in hand.