The vulnerability identified as CVE-2026-24571 affects boxnow BOX NOW Delivery up to version 3.0.2. It is characterized by missing authorization checks that result in incorrectly configured access control security levels. This allows an attacker with low privileges to perform unauthorized actions that impact data integrity. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, required privileges at a low level, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact. No patch or official remediation information is currently available.

The vulnerability allows unauthorized modification of data within the affected BOX NOW Delivery application, potentially leading to integrity issues. Confidentiality and availability are not impacted. Since no known exploits are reported, the immediate risk appears limited but could increase if exploitation techniques emerge.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected BOX NOW Delivery versions to trusted users only and monitor for unusual activity related to access control. Avoid deploying affected versions in sensitive environments where unauthorized data modification could cause significant impact.