FlexCity EUVD-2026-46186

Exploitation requires that a victim user click an attacker-crafted URL served from the FlexCity application, making user interaction (UI:R per CVSS) the primary limiting factor - passive or automated network-level exploitation is not possible. No attacker authentication is required (PR:N). The redirect functionality must be accessible via an HTTP/S endpoint in FlexCity, which the description implies is standard application behavior rather than a non-default feature. Affected versions are limited to 5.536.0 through 11052026; versions outside this range are not confirmed vulnerable. No indication of a required special configuration or deployment mode was found in the available data.

The CVSS 6.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates network-reachable, low-complexity, unauthenticated attack requiring one user interaction (clicking a crafted link). The Changed scope elevates the score from what would otherwise be a lower-impact local issue. No EPSS score was provided in available data, so exploitation probability cannot be quantitatively assessed. No CISA KEV listing exists, and no public POC was identified, suggesting the vulnerability is not currently being exploited at scale. Real-world risk is moderate: open redirects are routinely weaponized in spear-phishing campaigns precisely because the initial URL bears a legitimate, trusted domain - lending credibility before the redirect occurs. The absence of an availability impact (A:N) and the limited C:L/I:L scope means this vulnerability does not enable direct system compromise, but its social-engineering utility is well-documented in threat actor toolkits.

An attacker registers a convincing lookalike phishing domain (e.g., mimicking the organization's login portal) and crafts a FlexCity URL embedding the phishing site as the redirect target parameter. The URL is delivered via email or messaging using the trusted FlexCity domain as the visible link, increasing click-through likelihood; upon clicking, the user is silently forwarded to the attacker-controlled site where credentials are harvested. No public POC exists at time of analysis, but this attack pattern requires only a text editor and a hosting account - no specialized tooling.