The vulnerability is an identity-based authorization bypass that permits an attacker to alter a legitimate user’s data, including changing the email address, validating that address, and requesting password resets. This enables the attacker to assume control of other users’ accounts, compromising confidentiality, integrity, and availability of user data. The weakness correlates with CWE‑639, reflecting improper authorization controls.

Affected vendors include Wakyma, specifically their application web product. All versions of the Wakyma application web are vulnerable until the fix deployed by their continuous integration pipeline on February 19, 2026.

The CVSS score of 8.6 classifies this as high severity, indicating significant risk if exploited. The EPSS score of less than 1% suggests low current exploit probability, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector involves sending crafted HTTP requests to protected endpoints lacking proper identity checks, which an authenticated or partially authenticated user could exploit to modify other users’ data.