The CVE details a missing authorization flaw in Caz Informatics Services Trade Inc.'s Advancity ALMS Cloud that allows users to access functionality that should be restricted by ACLs. This weakness corresponds to CWE-862, indicating an improper access control. The impact permits potential data exposure, manipulation, or other unauthorized operations depending on the privilege level of the compromised account. Based on the description, it is inferred that an attacker would need an authenticated session to exploit the flaw.

The affected product is Advancity ALMS Cloud from Caz Informatics Services Trade Inc.; all versions released prior to or on 2026‑10‑08 are considered at risk. No specific version range is listed, so every current deployment of the application is potentially affected.

The CVSS score of 6.5 classifies the vulnerability as moderate. The EPSS score is not available and the issue is not listed in CISA KEV, indicating no widespread exploitation evidence yet. Based on the description, it is inferred that an attacker would need a valid authenticated session and knowledge of internal object identifiers to exploit the IDOR, making initial access a prerequisite. The likely attack vector is an authenticated user manipulating resource identifiers to bypass ACLs. Once the flaw is abused, an attacker could read or act on data of other users, potentially escalating privilege or compromising business operations.