The vulnerability CVE-2026-28071 in PixFort pixfort Core up to version 3.2.22 arises from missing authorization controls. This allows an attacker with low privileges to bypass access control restrictions, potentially accessing or modifying resources beyond their intended permissions. The CVSS 3.1 base score is 6.3, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level. No patch or official remediation details are currently provided.

An attacker with low privileges can exploit this missing authorization vulnerability to access or alter data or functionality that should be restricted, resulting in limited confidentiality, integrity, and availability impacts. The vulnerability does not require user interaction and can be exploited remotely over the network. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and strengthen access control configurations in pixfort Core deployments to ensure proper authorization enforcement. Monitor for vendor updates regarding patches or official mitigations.