CVE-2026-57703 is a broken access control vulnerability (CWE-862) affecting Sunshine Photo Cart versions up to and including 3.6.10.1. The issue arises from missing authorization checks, allowing users with some privileges to access or perform actions they should not be authorized for. The CVSS v3.1 base score is 6.3 (medium), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker with some level of access to bypass authorization controls, potentially leading to unauthorized disclosure of information, modification of data, or disruption of service within the affected application. The impact is rated medium based on the CVSS score and the described confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should carefully review and restrict user privileges to minimize exposure to this broken access control vulnerability.