CVE-2026-80254: Authorization bypass through user-controlled key in Shizen Connect Inc. ShizenBox2 (edge-app)

This vulnerability in ShizenBox2 (edge-app) allows an attacker who can authenticate to the system to bypass authorization controls by manipulating a user-controlled key. This flaw enables the attacker to change the password of other users, potentially leading to account takeover or privilege escalation within the application. The CVSS 3.0 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An authenticated attacker can change other users' passwords, compromising account integrity and potentially leading to unauthorized access or privilege escalation. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict login access to trusted users only and monitor for suspicious password changes.