CVE-2026-15219: CWE-639 Authorization bypass through User-Controlled key in SFM Software Technologies Inc. Costifier

This vulnerability (CVE-2026-15219) in Costifier by SFM Software Technologies Inc. is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). It allows an attacker with some level of privileges (low privileges required) to bypass authorization controls by manipulating trusted identifiers, specifically through a user-controlled key. The vulnerability affects all versions up to and including 2026-10-16. No vendor response or patch has been provided as of the publication date.

An attacker with low privileges can exploit this vulnerability to bypass authorization mechanisms, potentially leading to unauthorized actions or privilege escalation within the affected Costifier software. The confidentiality impact is none, but integrity is high, and availability is not affected. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. In the meantime, restrict access to trusted users and consider additional access controls to mitigate risk.