CVE-2026-59536 is an unauthenticated broken access control vulnerability (CWE-862) affecting CoCart – Headless ecommerce software versions up to 4.8.4. This flaw allows attackers without any privileges to bypass authorization mechanisms, potentially leading to unauthorized modification of data or system state. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting high impact on integrity with network attack vector, low attack complexity, and no required privileges or user interaction. No patch or official remediation level has been disclosed as of the publication date.

The vulnerability allows unauthenticated attackers to bypass authorization controls, which can lead to unauthorized modification of data or system functions, impacting the integrity of the affected system. There is no reported impact on confidentiality or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the affected service and monitor for suspicious activity related to unauthorized access attempts. Follow vendor communications closely for updates on patches or mitigations.