CVE-2025-50849 describes an IDOR vulnerability in CS Cart 4.18.3 where the user profile feature improperly validates the company_id parameter used to toggle sticker settings. An authenticated attacker can alter this parameter to affect other users' accounts, resulting in unauthorized changes. The vulnerability has a CVSS v3.1 score of 8.0, indicating high severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation allows an authenticated user to modify sticker settings on other users' accounts without authorization. This can lead to unauthorized changes affecting user experience and potentially exposing or altering user-specific settings. The CVSS score indicates high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected functionality to trusted users only and monitor for suspicious activity related to sticker setting changes. Avoid relying on client-side validation and implement proper server-side authorization checks for object references.