The flaw is an IDOR where a user-controlled key is used to access resources without proper ownership checks. An attacker can supply arbitrary key values to bypass authorization and gain access to data or functionality intended for other users. This can lead to confidential data exposure or unintended modification of application state.

SFM Software Technologies Inc. Costifier is affected. All released versions up to the date of disclosure (2026‑10‑16) are potentially impacted; no specific version numbers were provided by the vendor.

The CVSS score of 6.5 indicates a medium risk level. EPSS information is unavailable and the vulnerability is not listed in the CISA KEV catalog, so the overall likelihood of exploitation remains uncertain. Based on the description, the likely attack vector is a web or API endpoint where a malicious user can supply a controlled key. No exploit details are publicly available, so detection would rely on logs of unauthorized resource access.