CVE-2026-40043 describes an authorization bypass vulnerability in Pachno 1.0.6. The issue exists in the runSwitchUser() action, where the application trusts a client-controlled cookie named original_username. This allows an authenticated low-privilege user to manipulate the cookie value to impersonate the administrator user (user ID 1). Successful exploitation can lead to privilege escalation by obtaining administrator session tokens or password hashes. The vulnerability is remotely exploitable over the network without user interaction and requires only low privileges to initiate.

An attacker with valid low-privilege credentials can escalate their privileges to administrator level by exploiting this vulnerability. This could lead to unauthorized access to sensitive administrative functions, session hijacking, or credential compromise. The impact is significant given the ability to access administrator session tokens or password hashes, potentially compromising the entire system's security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to Pachno 1.0.6 to trusted users only and monitor for suspicious activity related to user switching. Avoid using this version in production environments where privilege escalation risk is unacceptable.