This vulnerability (CVE-2026-59540) involves incorrect privilege assignment in the SMS Alert Order Notifications product by Cozy Vision Technologies Pvt. Ltd., affecting versions up to 3.9.6. It permits unauthenticated attackers to escalate privileges, resulting in high impact on confidentiality, integrity, and availability as reflected by a CVSS 3.1 base score of 9.8. The vulnerability is categorized under CWE-266, which concerns improper privilege management. There is no vendor advisory or patch available at this time, and the product is not a cloud service, so remediation is the responsibility of the user.

Successful exploitation of this vulnerability allows unauthenticated attackers to escalate their privileges, potentially gaining unauthorized access and control over the affected system. This leads to a critical impact on confidentiality, integrity, and availability of the system and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Cozy Vision Technologies Pvt. Ltd. communications for updates and apply patches once available. In the meantime, restrict access to the affected system and consider additional access controls to limit exposure.