Comarch ERP Optima client software improperly uses a high privileged database account for all connections, independent of the actual user account. This incorrect privilege assignment (CWE-266) allows a local attacker with control over the client process to extract credentials from memory and escalate privileges to the database level. The vulnerability requires the client to be configured but not necessarily logged in. It has a CVSS 4.0 score of 7.5 (high severity). The vendor fixed this issue in version 2026.4.

An attacker with local access to the client machine can extract high privileged database credentials from the client process memory, enabling unauthorized privileged access to the database. This could lead to unauthorized data access or modification at the database level. No known exploits in the wild have been reported.

The vulnerability is fixed in Comarch ERP Optima version 2026.4. Users should upgrade to this version to remediate the issue. No official patch or workaround is provided for earlier versions, so upgrading is the recommended action. Since this is not a cloud service, remediation depends on applying the vendor's fixed version.