This vulnerability (CVE-2026-40792) in KiviCare (<= 4.2.1) is an authorization bypass due to insecure direct object references (IDOR), categorized under CWE-639. It allows a user with limited privileges to bypass authorization controls by manipulating user-controlled keys, potentially leading to unauthorized access or modification of subscriber information. The CVSS 3.1 score is 6.3 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An attacker with low privileges can exploit this vulnerability to bypass authorization controls and access or modify subscriber data improperly. The impact includes limited confidentiality, integrity, and availability loss, as indicated by the CVSS vector. This could lead to unauthorized data exposure or manipulation within the affected KiviCare installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected KiviCare versions and monitor for unusual activity related to subscriber data access. Avoid exposing the vulnerable functionality to untrusted users where possible.