CVE-2026-14953: CWE-425 Direct Request ('Forced Browsing') in Frauscher Sensortechnik FDS 102

This vulnerability (CVE-2026-14953) affects Frauscher Sensortechnik FDS 102 versions >=2.11.0 and <=2.13.3. It enables a remote attacker with low privileges to access the /api/user/fetch-all.php endpoint to enumerate all user accounts and identify those with elevated privileges. The flaw is classified as CWE-425 (Direct Request or Forced Browsing), indicating insufficient access control on this API endpoint. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low complexity, no privileges required beyond low, and no user interaction needed.

An attacker with low privileges can remotely enumerate all user accounts and identify which users have elevated privileges. This information disclosure can aid further targeted attacks or privilege escalation attempts. There is no indication of direct code execution or data modification from this vulnerability alone.

No official patch or remediation has been provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /api/user/fetch-all.php endpoint to authorized users only, if possible, and monitor for suspicious access patterns.