CVE-2026-10597 is an authorization bypass vulnerability in ITPison's OMICARD EDM version 5.8. The flaw arises from insecure direct object references, enabling unauthenticated remote attackers to modify a specific parameter and retrieve users' email addresses without proper authorization checks. The vulnerability has a CVSS 4.0 score of 6.9, indicating a medium severity impact. No vendor advisory or patch information is currently provided, and the product is not a cloud service.

An attacker can remotely and without authentication access email addresses of users by exploiting the insecure direct object reference vulnerability. This could lead to privacy breaches and potential further phishing or social engineering attacks. There is no indication of privilege escalation or system compromise beyond disclosure of email addresses.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected version where possible and monitor for suspicious activity related to unauthorized data access.