CVE-2026-1597 is an improper authorization vulnerability identified in Bdtask SalesERP, specifically affecting versions up to 20260116. The vulnerability arises from insufficient validation of the ci_session argument within an administrative endpoint, allowing attackers to manipulate session parameters to bypass authorization controls. This flaw can be exploited remotely without requiring authentication or user interaction, making it accessible to unauthenticated attackers over the network. The vulnerability impacts the confidentiality, integrity, and availability of the system by potentially granting unauthorized administrative access, which could lead to unauthorized data access or modification and disruption of ERP operations. The vendor has been notified but has not responded or released a patch, leaving systems exposed. The CVSS 4.0 base score is 5.3, indicating medium severity, with the vector highlighting network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on confidentiality, integrity, and availability. No known exploits have been reported in the wild, but public disclosure increases the risk of exploitation. The lack of vendor response and patch availability necessitates immediate mitigation efforts by affected organizations to reduce risk.

The vulnerability allows remote attackers to bypass authorization mechanisms in the administrative endpoint of Bdtask SalesERP, potentially gaining unauthorized administrative privileges. This can lead to unauthorized access to sensitive business data, manipulation of ERP configurations, and disruption of business processes. The impact on confidentiality includes exposure of sensitive data; integrity impact involves unauthorized modification of data or system settings; availability impact could arise from malicious changes causing system outages. Since the vulnerability requires no authentication or user interaction, exploitation is relatively easy, increasing risk. Organizations relying on SalesERP for critical business functions may face operational disruptions, financial losses, and reputational damage. The absence of a vendor patch prolongs exposure, increasing the window for potential attacks. However, the limited scope of the vulnerability to a specific component and the lack of known exploits in the wild somewhat mitigate immediate widespread impact.

1. Implement strict network-level access controls to restrict access to the administrative endpoint only to trusted IP addresses or VPN users. 2. Employ Web Application Firewalls (WAFs) with custom rules to detect and block suspicious manipulation of session parameters, particularly the ci_session argument. 3. Conduct thorough logging and monitoring of administrative endpoint access to detect anomalous or unauthorized attempts promptly. 4. Enforce multi-factor authentication (MFA) on all administrative accounts to add an additional layer of security, even if authorization bypass is attempted. 5. Isolate the SalesERP administrative interface on a separate network segment to limit exposure. 6. Regularly audit user privileges and session management mechanisms to identify and remediate potential weaknesses. 7. Engage with the vendor or community to obtain updates or patches as soon as they become available. 8. Consider temporary compensating controls such as disabling remote administrative access if feasible until a patch is released. 9. Educate IT and security teams about this specific vulnerability to ensure rapid incident response if exploitation attempts are detected.