This vulnerability (CVE-2026-7380) is classified as CWE-80, indicating improper neutralization of script-related HTML tags in web pages, leading to basic cross-site scripting (XSS). It affects Armiya Information Technologies Ltd. Co.'s Access Control System (GKS) versions prior to 2. The XSS flaw allows injection of malicious scripts targeting HTML attributes, potentially impacting confidentiality and integrity. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to execute malicious scripts in the context of the affected web application, potentially leading to partial disclosure of information and modification of data within the user's session. The vulnerability does not impact system availability. The scope change in CVSS indicates that the vulnerability could affect components beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules to detect and block XSS attempts. Monitor vendor communications for updates on patches or official mitigations.