CVE-2026-110372: Incorrect Privilege Assignment in Brainstorm Force OttoKit

CVE-2026-110372 describes an Incorrect Privilege Assignment vulnerability in Brainstorm Force's OttoKit product, affecting all versions from initial release up to 1.1.40 inclusive. The vulnerability enables an attacker to escalate privileges without authentication or user interaction, resulting in complete compromise of the affected system. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, so the patch status is not confirmed.

Successful exploitation of this vulnerability allows an unauthenticated attacker to escalate privileges, potentially gaining full control over the affected system. This can lead to unauthorized data access, modification, or disruption of service. The critical CVSS score (9.8) reflects the high severity and potential for significant damage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected OttoKit versions and monitor for suspicious activity related to privilege escalation attempts.