CVE-2026-32582: CWE-862 Missing Authorization in iatoai IATO MCP

This vulnerability, identified as CVE-2026-32582, affects iatoai's IATO MCP product versions up to 1.11.0. It is a broken access control issue (CWE-862) where authorization checks are missing or insufficient, enabling attackers with low privileges to perform unauthorized operations that can alter system integrity. The CVSS 3.1 base score is 6.5, reflecting a network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No vendor advisory or patch information is available at this time.

An attacker with low privileges can exploit this missing authorization vulnerability to perform unauthorized actions that compromise the integrity of the IATO MCP system. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users and monitor for unauthorized activities related to authorization bypass.