CVE-2026-15219: IDOR in SFM Software's Costifier
Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers.
This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges (PR:L). Exploitation is network-accessible, requires no user interaction, and has low attack complexity.
What is the likely security impact if exploitation succeeds?
The reported impact is integrity-only (I:H), meaning successful exploitation can allow unauthorized modification of data or resources associated with trusted identifiers. No confidentiality or availability impact is reported in the supplied vector.
Is a vendor fix or mitigation available?
The available information does not identify a fixed version, workaround, or vendor advisory response. The disclosure notes that the vendor was contacted early but did not respond.