CVE-2026-84769: CWE-639 Authorization Bypass Through User-Controlled Key in Strategy11 Team Business Directory

This vulnerability (CVE-2026-84769) is an authorization bypass issue classified under CWE-639 (Authorization Bypass Through User-Controlled Key) affecting Strategy11 Team's Business Directory product versions up to 6.4.26. It allows unauthenticated attackers to exploit insecure direct object references (IDOR) by manipulating user-controlled keys, potentially leading to unauthorized access to restricted resources. The CVSS 3.1 score of 6.5 reflects that the attack can be performed remotely without authentication, with low attack complexity and no required user interaction, impacting confidentiality and integrity but not availability.

An attacker can bypass authorization controls without authentication by exploiting insecure direct object references, potentially gaining unauthorized access to sensitive information or functionality within the affected Business Directory versions. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Strategy11 Team's advisories for updates. Until a patch is available, consider restricting access to the affected Business Directory installation or implementing additional access controls to mitigate unauthorized access risks.