CVE-2026-49192CWE-639

Summary Service Insecure Direct Object Reference

Medium · published June 4, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
13.1
In the wild
Unconfirmed
What it is

The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00230 · 13.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-06-04T05:43Z
EPSS history
Timeline
  • 04 JUN 05:43Z
    Summary Service Insecure Direct Object Reference
    cvelistv5