CVE-2026-95594: CWE-266 Incorrect Privilege Assignment in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications

This vulnerability (CWE-266) involves incorrect privilege assignment in the SMS Alert Order Notifications software by Cozy Vision Technologies Pvt. Ltd. Versions up to 4.0.0 are affected. The flaw allows unauthenticated attackers to escalate their privileges, potentially gaining unauthorized access or control. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without user interaction but requires high attack complexity.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability, as the attacker can escalate privileges without authentication. This could allow unauthorized access to sensitive data, manipulation of system functions, or denial of service.

No patch or official remediation information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict network access to the affected service and monitor for suspicious activity related to privilege escalation attempts.