CVE-2026-47755 is an authorization bypass vulnerability in the ITFlow product by itflow-org. Before version 26.05, a low-privileged authenticated agent can retrieve sensitive information such as plaintext credentials and TOTP secrets belonging to other clients by directly requesting the credential edit modal with an arbitrary credential_id. The vulnerability arises because the endpoint does not enforce client scoping or object-level authorization checks prior to loading and decrypting the credential record. This allows unauthorized access to sensitive authentication data. The issue is resolved in version 26.05.

An attacker with low-privileged authenticated access can obtain plaintext credentials and TOTP secrets of other clients, leading to potential compromise of client accounts and authentication mechanisms. The confidentiality of sensitive authentication data is directly impacted. There is no indication of impact to integrity or availability.

Upgrade ITFlow to version 26.05 or later, where this authorization bypass vulnerability is fixed. Patch status is not explicitly stated but the vendor has fixed the issue in 26.05. Until upgrading, restrict access to trusted users only and monitor for suspicious access patterns involving credential_id parameters.