CVE-2026-84836: CWE-639 Authorization Bypass Through User-Controlled Key in kirillbdev WC Ukraine Shipping

This vulnerability, identified as CVE-2026-84836, affects kirillbdev WC Ukraine Shipping software versions up to 1.22.3. It is an authorization bypass issue caused by Insecure Direct Object References (IDOR), where a user can manipulate a key parameter to access unauthorized subscriber data. The CVSS 3.1 score is 7.1, indicating high severity, with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. No vendor advisory or patch information is available, and no known active exploitation has been reported.

An attacker with some level of privileges can bypass authorization controls to access or manipulate subscriber data that should be restricted. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and limited integrity impact. There is no impact on availability. The vulnerability could compromise subscriber privacy and data security within the affected application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected application to trusted users only and monitor for suspicious activity related to subscriber data access. Avoid exposing the vulnerable functionality to untrusted users.