This vulnerability (CVE-2026-5799) in Ontime allows an attacker to bypass authorization controls by manipulating a user-controlled key, exploiting trusted identifiers. This is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). The issue affects Ontime versions through 04052026. The CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact without integrity or availability impact. No remediation level or patch information is provided, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to bypass authorization mechanisms and gain unauthorized access to sensitive information, impacting confidentiality. There is no reported impact on integrity or availability. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected Ontime instances and monitor for unusual access patterns related to authorization keys. Follow vendor communications closely for updates on patches or mitigations.