Kitlogistic
Monthly
Unauthenticated remote access to ACL-restricted functionality in KitLogistic (all versions before v2.2.2) exposes high-confidentiality data without requiring any credentials. The root cause is CWE-862 Missing Authorization: the application does not enforce permission checks on certain endpoints, allowing any network-reachable user to retrieve sensitive logistics data. No public exploit code or active exploitation has been identified at time of analysis, but the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial, unauthenticated network exploitation against default deployments.
Unauthenticated remote access to ACL-restricted functionality in KitLogistic (all versions before v2.2.2) exposes high-confidentiality data without requiring any credentials. The root cause is CWE-862 Missing Authorization: the application does not enforce permission checks on certain endpoints, allowing any network-reachable user to retrieve sensitive logistics data. No public exploit code or active exploitation has been identified at time of analysis, but the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial, unauthenticated network exploitation against default deployments.