CVE-2026-39477

CVE-2026-39477 is a missing authorization vulnerability in Brainstorm Force CartFlows plugin versions 2.2.3 and earlier that allows authenticated users to exploit incorrectly configured access control security levels. The flaw enables privilege escalation through improperly restricted endpoints accessible to users with lower privilege levels. The vulnerability carries a CVSS 3.1 score of 4.3 (Medium severity) with a network-based attack vector requiring low complexity and valid user credentials. The impact is limited to integrity violations with no confidentiality or availability impact. The EPSS score of 0.0003 indicates minimal likelihood of widespread exploitation across the threat landscape. There is currently no evidence of active exploitation or public exploit code availability. The vulnerability is not listed on the KEV catalog and remains inactive on threat tracking lists, suggesting limited community attention and low real-world threat activity at this time.