This vulnerability (CVE-2026-2406) in the Online Registration and Workflow Management System by Universe Software Computer Marketing Trade and Industry Inc. allows an attacker to bypass authorization controls by exploiting a user-controlled key, which leads to trust being placed incorrectly in client-supplied data. The issue is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

The vulnerability enables an attacker with at least low privileges (PR:L) to bypass authorization mechanisms remotely (AV:N) without user interaction (UI:N), potentially gaining unauthorized access to sensitive data (Confidentiality impact is high). Integrity and availability are not impacted. This could lead to unauthorized disclosure of information within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix or vendor advisory, monitor for updates from Universe Software Computer Marketing Trade and Industry Inc. and apply any patches or mitigations they provide once available.