This vulnerability (CVE-2025-13479) in PosCube's QR Menu product is an authorization bypass caused by improper handling of user-controlled keys, classified under CWE-639 (Authorization Bypass Through User-Controlled Key). It allows attackers to exploit trusted identifiers to gain unauthorized access. The issue affects QR Menu versions through 21052026. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low attack complexity, no privileges required, and no user interaction needed. The vendor has not provided any response or patch, and no official remediation level is assigned.

Successful exploitation of this vulnerability could allow an attacker to bypass authorization controls and access functionality or data without proper permissions. The impact is limited to confidentiality as indicated by the CVSS vector (C:H/I:N/A:N), meaning sensitive information could be exposed but integrity and availability are not affected. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should monitor for updates from PosCube Hardware Software and Consulting Ltd. and consider implementing compensating controls to restrict access to the QR Menu system until a fix is released.