CVE-2026-3999 details a high-severity broken access control vulnerability that could enable an authenticated user to perform horizontal privilege escalation within specific, unlisted product configurations. Rated 8.8 HIGH on CVSS 4.0, this flaw features a network attack vector, low attack complexity, and requires only low privileges, posing a significant risk to confidentiality and integrity. There is currently no evidence of active exploitation, nor is public exploit code available on platforms like Metasploit or ExploitDB. Community discussion and media coverage are absent, and its exceptionally low EPSS score indicates minimal current public attention or perceived threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, < 9.0.0CPE match | cpe:2.3:a:pointsharp:id_server:*:*:*:*:*:*:*:* | ||
< 9.0.0CPE matchmatch criteria | cpe:2.3:a:pointsharp:id_server:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.