This vulnerability, tracked as CVE-2026-1619, affects Universal Software Inc.'s FlexCity/Kiosk product versions 1.0 up to but not including 1.0.36. It is categorized under CWE-639, indicating an authorization bypass through user-controlled keys. The flaw allows attackers with low privileges to bypass authorization mechanisms by manipulating trusted identifiers, potentially gaining unauthorized access to sensitive information or functionality. The CVSS 3.1 base score is 8.3, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality and integrity with low impact on availability.

Successful exploitation of this vulnerability could allow an attacker with some privileges to bypass authorization controls, leading to unauthorized disclosure and modification of sensitive data. The impact on system availability is low. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently documented, organizations should monitor Universal Software Inc. communications for updates. Until a fix is available, restrict access to affected versions and apply compensating controls where possible to limit exposure to untrusted users.