MicroRealEstate through version 1.0.0-alpha3 suffers from broken object-level access controls in its PDF generator functionality, classified as CWE-639. This flaw permits unauthorized users with limited privileges to access or manipulate objects they should not be able to, potentially leading to unauthorized information disclosure or modification. The vulnerability has been assigned CVE-2026-57868 and GHSA-qjq2-685q-j8gv identifiers. There is no vendor advisory or patch available, and no known exploits have been reported. The CVSS 4.0 vector indicates a network attack vector with low attack complexity and no user interaction required, emphasizing the high impact of this vulnerability.

The vulnerability allows unauthorized access to objects within the PDF generator functionality, potentially leading to unauthorized information disclosure or unauthorized actions within the affected application. Since the access control is broken at the object level, attackers with limited privileges may escalate their access or retrieve sensitive data improperly. No known exploits are reported, so the real-world impact is currently theoretical but considered high risk due to the nature of the flaw.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the PDF generator functionality to trusted users only and monitor for unusual activity related to PDF generation. Avoid exposing the affected versions in untrusted environments.