The vulnerability is an IDOR (Insecure Direct Object Reference) in PosCube Hardware Software and Consulting Ltd.'s QR Menu. An attacker can control the key used to access menu items, bypassing authorization checks and gaining access to trusted identifiers. This flaw aligns with CWE‑639 and can lead to unauthorized use of QR Menu functions, potentially exposing internal transaction data or enabling further manipulation of POS operations.

The affected product is PosCube Hardware Software and Consulting Ltd.'s QR Menu. All releases up through version 21052026 are impacted. No official patch has been issued yet. The vendor has not responded to notification.

The CVSS score of 7.5 indicates a high risk, and the lack of an EPSS rating suggests current exploit data is uncertain. The vulnerability can be exploited remotely by crafting a malicious QR code or sending a crafted request that provides a user‑controlled key, thereby bypassing authentication. The issue is not listed in the CISA KEV catalog, but its high CVSS score and the ease of exploitation through the QR interface make it a priority for vendors and users to mitigate promptly.