CVE-2026-59535 is a missing authorization vulnerability (CWE-862) affecting Thrive Product Manager versions up to 10.9.2. It allows unauthenticated attackers to bypass access controls, potentially leading to unauthorized information disclosure, modification, or disruption of service. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, with low attack complexity. The vulnerability is publicly disclosed but lacks an official fix or vendor advisory at this time.

The vulnerability enables unauthenticated attackers to bypass access controls, which can lead to limited confidentiality, integrity, and availability impacts on the affected product. This may allow unauthorized access to sensitive information or unauthorized actions within the Thrive Product Manager environment. The CVSS score of 7.3 reflects a high impact but does not specify critical system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Thrive Product Manager instances and monitor for unusual activity. Avoid exposing the affected versions to untrusted networks. Follow vendor communications for updates on patches or official mitigations.