The flaw is an IDOR where a user‑controlled key is used to identify protected resources without proper ownership checks. An attacker can supply arbitrary key values to bypass authorization and gain access to data or functionality intended for other users, potentially exposing confidential information or modifying application state. This weakness is classified as CWE‑639, authorization bypass through user‑controlled input.

SFM Software Technologies Inc. Costifier is affected. All released versions up to the date of disclosure (2026‑10‑16) are potentially impacted; no specific version numbers were provided by the vendor.

The CVSS score of 6.5 indicates a medium risk level. The EPSS score of 0.00195 shows a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a web or API endpoint where a malicious user can supply a controlled key. No exploit details are publicly available, so detection would rely on logs of unauthorized resource access.