Costifier
Monthly
Exposed debug/diagnostic interfaces in SFM Software Technologies Inc.'s Costifier application let unauthenticated remote attackers reach non-production code paths in production deployments, resulting in limited information disclosure. The flaw carries a medium-severity CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning no credentials, no user interaction, and no special conditions are needed once the debug interface is network-reachable; integrity and availability are unaffected. All Costifier versions released through 2026-10-16 are in scope, the vendor was contacted but did not respond, and no public exploit identified at time of analysis.
Authorization bypass in SFM Software Technologies Inc.'s Costifier allows any authenticated user to reach or alter resources belonging to other users by manipulating a trusted, user-controlled object identifier. The flaw is rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), a moderate-severity CWE-639 (Authorization Bypass Through User-Controlled Key) issue that requires only low-privilege credentials - remote unauthenticated exploitation is not possible, and no user interaction is needed. All Costifier versions through the 2026-10-16 build are affected; the vendor was contacted but did not respond, so no patched version is confirmed, and no public exploit identified at time of analysis. Because integrity impact is rated High while confidentiality and availability are None, the primary risk is unauthorized modification of other users' records rather than bulk data exposure.
Exposed debug/diagnostic interfaces in SFM Software Technologies Inc.'s Costifier application let unauthenticated remote attackers reach non-production code paths in production deployments, resulting in limited information disclosure. The flaw carries a medium-severity CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning no credentials, no user interaction, and no special conditions are needed once the debug interface is network-reachable; integrity and availability are unaffected. All Costifier versions released through 2026-10-16 are in scope, the vendor was contacted but did not respond, and no public exploit identified at time of analysis.
Authorization bypass in SFM Software Technologies Inc.'s Costifier allows any authenticated user to reach or alter resources belonging to other users by manipulating a trusted, user-controlled object identifier. The flaw is rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), a moderate-severity CWE-639 (Authorization Bypass Through User-Controlled Key) issue that requires only low-privilege credentials - remote unauthenticated exploitation is not possible, and no user interaction is needed. All Costifier versions through the 2026-10-16 build are affected; the vendor was contacted but did not respond, so no patched version is confirmed, and no public exploit identified at time of analysis. Because integrity impact is rated High while confidentiality and availability are None, the primary risk is unauthorized modification of other users' records rather than bulk data exposure.