CVE-2026-57646 is an IDOR vulnerability affecting Majestic Support software versions up to 1.1.7. It allows an attacker with limited privileges to directly access subscriber objects without proper authorization checks, leading to unauthorized disclosure and potential modification of subscriber data. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates the attack can be performed remotely over the network with low complexity and requires low privileges, impacting confidentiality and integrity at a low level but not availability. There is no known exploit in the wild and no official patch or remediation details have been provided.

An attacker with limited privileges can exploit this vulnerability to access and potentially modify subscriber information that should be restricted. This leads to unauthorized disclosure and integrity issues of subscriber data. There is no impact on system availability. The overall severity is moderate given the low confidentiality and integrity impact and the requirement for some privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to subscriber data to trusted users only and monitor for unauthorized access attempts. Avoid granting unnecessary privileges that could be leveraged to exploit this vulnerability.