CVE-2026-94590: Improper Verification of Source of a Communication Channel in CodePeople2 Sell Downloads

This vulnerability in CodePeople2 Sell Downloads arises from improper verification of the source of a communication channel, which can be exploited to misuse trusted credentials. The affected versions include all releases prior to 1.2.4. The CVSS 3.1 vector indicates that the attack can be performed remotely without privileges or user interaction, impacting confidentiality and integrity with no impact on availability. No vendor advisory or patch information is available, so remediation status is unknown.

Exploitation of this vulnerability could allow an attacker to leverage trusted credentials improperly, potentially leading to unauthorized disclosure or modification of data within the affected application. The impact affects confidentiality and integrity but does not affect availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates and consider restricting network access to the affected application to trusted sources where feasible.