CVE-2026-84758: CWE-862 Missing Authorization in Strategy11 Team Business Directory

This vulnerability is an unauthenticated broken access control flaw in Business Directory versions up to 6.4.26. It allows attackers without any privileges to bypass authorization checks, potentially modifying data or disrupting service. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but low integrity and low availability impacts. No patch or official remediation guidance has been published yet, and there are no known exploits in the wild.

The vulnerability allows unauthenticated attackers to perform unauthorized actions that can affect the integrity and availability of the Business Directory application. There is no impact on confidentiality. Exploitation could lead to data modification or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected Business Directory installations and monitor for unusual activity related to unauthorized access attempts.