CVE-2026-39749: CWE-862 Missing Authorization in digitalpoint App for Cloudflare®

This vulnerability (CVE-2026-39749) is a broken access control issue classified under CWE-862 affecting digitalpoint's App for Cloudflare® up to version 1.10.1. It allows a user with limited privileges (subscriber) to bypass authorization controls, leading to unauthorized modification of data or actions (integrity impact). The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and unchanged scope. The vendor provides a patch, and since this is a cloud service, remediation is managed by the vendor.

The vulnerability impacts the integrity of the system by allowing unauthorized actions due to missing authorization checks. Confidentiality and availability are not affected. The attack requires network access and privileges at the subscriber level but no user interaction. There are no known exploits in the wild at this time.

A patch is available for this vulnerability. Since the product is a cloud-hosted service, the vendor manages remediation server-side. Users should verify with the vendor advisory that their service instance has been updated to address this issue.