CVE-2026-47755 is an authorization bypass vulnerability in itflow (an IT documentation, ticketing, and accounting system) affecting versions before 26.05. A low-privileged authenticated agent can exploit this flaw by requesting the credential edit modal with an arbitrary credential_id, thereby accessing plaintext credentials and TOTP secrets belonging to other clients. The root cause is the lack of client scoping and object-level authorization checks before loading and decrypting credential records. The vulnerability is addressed in version 26.05.

An attacker with low-level authenticated access can obtain sensitive plaintext credentials and TOTP secrets of other clients, potentially compromising client accounts or systems. The vulnerability impacts confidentiality but does not affect integrity or availability. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality impact.

Upgrade to itflow version 26.05 or later, where this authorization bypass vulnerability is fixed. No other mitigation or workaround is indicated. Patch status is not explicitly stated but the vendor has fixed the issue in version 26.05.