CVE-2026-39637 describes a missing authorization vulnerability in SpabRice Mogi versions up to 1.2.3. The issue arises from incorrectly configured access control security levels, which may allow unauthorized network-based access to certain data or functions without requiring privileges or user interaction. The CVSS vector indicates the attack can be performed remotely with low complexity and no privileges or user interaction needed, impacting confidentiality but not integrity or availability. No official remediation or patch has been published yet, and no exploits are known in the wild.

The vulnerability impacts confidentiality by potentially allowing unauthorized disclosure of information due to missing authorization controls. There is no impact on integrity or availability according to the CVSS vector. No known exploits have been reported, so the risk is theoretical until exploitation is observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict network access to the affected versions of SpabRice Mogi where possible and monitor for updates from the vendor. No specific mitigations have been provided by the vendor at this time.