CVE-2026-110882: Missing Authorization in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications

This vulnerability in the SMS Alert Order Notifications plugin by Cozy Vision Technologies Pvt. Ltd. involves missing authorization checks, which means that certain functions can be accessed without proper permission validation. This is due to incorrectly configured access control security levels. The affected versions range from initial releases through 4.0.1. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring low privileges, no user interaction, and impacting integrity but not confidentiality or availability.

The vulnerability allows an attacker with low privileges to perform unauthorized actions that could alter data or system behavior, impacting the integrity of the affected system. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits are reported in the wild.

No official patch or vendor advisory is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review and tighten access control configurations to ensure proper authorization checks are enforced for all sensitive operations.