A missing authorization flaw in TBC Technology Inc.’s KitLogistic software lets an attacker access functions that are not correctly protected by access‑control lists. The vulnerability allows the attacker to read or manipulate data they should not be able to reach, potentially compromising confidentiality of client information or operational data.

The flaw exists in all KitLogistic versions earlier than 2.2.2. It is limited to products sold by TBC Technology Inc. and does not affect later releases. Users of KitLogistic software older than the 2.2.2 release should verify their current version and plan to upgrade.

The CVSS score of 7.5 indicates high severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified from the score alone. The vulnerability is not listed in the CISA KEV catalog. Because the attack vector requires that the attacker can reach the affected functionality—likely through a web or network interface—appropriate network segmentation and monitoring, as well as timely patching, are essential to mitigate risk.