GAPTEQ Designer EUVD-2026-60352

The concrete prerequisite named in the CVE is abuse of the GAPTEQ 'Company Manager' role, so realistic exploitation requires the attacker to hold or acquire a Company Manager account on a GAPTEQ Designer v3.5 instance and to have network reach to its web interface. This role requirement is the primary limiting factor - despite the published PR:N (unauthenticated) metric, the description implies an authenticated, role-scoped starting point rather than anonymous access, which meaningfully narrows the exploit population to environments where lower-tier delegated admins are not fully trusted.

The signals conflict and should be weighed carefully. The published CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) implies fully unauthenticated network exploitation, yet the description ties the flaw to abuse of the 'Company Manager role,' which strongly implies the attacker must already hold that authenticated role - meaning PR:N is likely optimistic and the true privilege requirement is PR:L; verify with the vendor. SSVC raises priority (Exploitation: PoC, Automatable: yes, Technical Impact: total) and a public PoC repository exists, but the low EPSS (0.21%) and absence from CISA KEV indicate no confirmed widespread active exploitation to date. Because a working PoC is public and the impact is total, the practical takeaway is that even a mid-sized municipal IT team in olsztyn should treat a reachable GAPTEQ Designer instance as an urgent internal-hardening priority, while recognizing that real-world risk is bounded by the platform's limited deployment footprint and the probable need for an existing Company Manager account. Net: a genuine high-priority issue for organizations running GAPTEQ, but likely role-gated rather than a fully anonymous internet-wide threat.

An attacker who obtains or is granted a 'Company Manager' role account in a GAPTEQ Designer 3.5 instance manipulates the role's functionality to escalate to higher (e.g., global administrative) privileges, gaining full control over the application's data and configuration. Because a public PoC exists and the CVSS complexity is low (AC:L), the technique is repeatable and, per SSVC, automatable once access to the role is available.