This vulnerability (CVE-2025-9062) in Envanty before version 1.0.6 involves an authorization bypass through user-controlled key parameter injection, classified under CWE-639. An attacker with low privileges can exploit this flaw to gain unauthorized read and write access to sensitive information, impacting confidentiality and integrity but not availability. The CVSS 3.1 vector indicates the attack requires adjacent network access, low complexity, no user interaction, and privileges at a low level. The vendor did not respond to disclosure attempts, but the issue was verified and remediated by the reporter. No official patch or advisory is publicly available.

Successful exploitation allows an attacker with low privileges and adjacent network access to bypass authorization controls, resulting in high confidentiality and integrity impact. This means sensitive data can be accessed or modified without proper authorization. Availability is not affected. There are no known exploits in the wild, and the vulnerability affects versions before 1.0.6 of Envanty.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The reporter has indicated remediation through testing, suggesting that upgrading to Envanty version 1.0.6 or later may address the issue. Since no official vendor advisory or patch links are available, users should monitor for updates from MeCODE Informatics and Engineering Services Ltd. and apply any official fixes once released. Until then, restrict access to the affected Envanty instances to trusted users and networks to reduce risk.