CVE-2026-39756: CWE-639 Authorization Bypass Through User-Controlled Key in Wappointment team Wappointment

This vulnerability (CVE-2026-39756) affects Wappointment versions up to 2.7.7 and is classified as CWE-639: Authorization Bypass Through User-Controlled Key. It allows unauthenticated attackers to exploit insecure direct object references, potentially accessing or manipulating resources they should not be able to. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

Exploitation of this vulnerability could lead to unauthorized disclosure and modification of data within the Wappointment application. Since the attack requires no authentication, it increases the risk of unauthorized access to sensitive information. However, availability is not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or vendor advisory is provided, users should monitor official Wappointment channels for updates and consider restricting access or applying compensating controls until a fix is available.