CVE-2026-10597 is an authorization bypass vulnerability in ITPison's OMICARD EDM product, specifically version 5.8. The issue is an Insecure Direct Object Reference (CWE-639) that allows unauthenticated remote attackers to modify a specific parameter to retrieve users' email addresses. The vulnerability does not require user interaction or privileges and has a low complexity of attack. No official patch or remediation level has been provided by the vendor, and no known exploits are reported in the wild.

An attacker can remotely and without authentication bypass authorization controls by manipulating a user-controlled key parameter, resulting in unauthorized disclosure of users' email addresses. This exposure of personally identifiable information (PII) could lead to privacy violations or targeted phishing attacks. The vulnerability does not allow further system compromise or code execution based on the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected OMICARD EDM instance where possible and monitor for unusual access patterns related to user data retrieval. Avoid exposing the vulnerable parameter in untrusted contexts. Follow up with ITPison for updates on patches or official mitigations.