This vulnerability, identified as CVE-2026-39546, involves incorrect privilege assignment (CWE-266) in Techspawn MultiLoca software versions up to 4.2.15. It allows a subscriber-level user to escalate privileges, potentially gaining unauthorized access or capabilities. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, with high confidentiality impact, low integrity impact, and low availability impact. The vendor has not released a patch or official remediation, and no exploits are currently known in the wild.

Successful exploitation could lead to unauthorized privilege escalation from subscriber-level to higher privilege levels, compromising confidentiality significantly, with limited impact on integrity and availability. This could allow attackers to access sensitive information or perform actions beyond their intended permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber privileges as much as possible and monitor for unusual privilege escalations. Avoid granting unnecessary privileges to subscriber accounts.