CVE-2026-2398 describes an authorization bypass vulnerability in MobilMen 20T version 3 by Adam Retail Automation Ltd. The issue arises from improper authorization checks related to a user-controlled key, enabling privilege escalation. The vulnerability is tracked under CWE-639. Despite early contact, the vendor has not provided a response or patch. The CVSS v3.1 score of 8.8 reflects high impact on confidentiality, integrity, and availability with network attack vector and low attack complexity.

Successful exploitation of this vulnerability allows an attacker with some privileges to escalate their privileges further, potentially gaining full control over the affected system. This can lead to complete compromise of confidentiality, integrity, and availability of the MobilMen 20T device running version 3.

No official fix or patch is currently available from the vendor. Since the vendor did not respond to disclosure, users should consider implementing compensating controls such as restricting access to affected devices and monitoring for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance if it becomes available.