CVE-2026-39637

CVE-2026-39637 is a missing authorization vulnerability in SpabRice Mogi version 1.2.3 and earlier that stems from incorrectly configured access control security levels. This flaw allows unauthenticated attackers to bypass authorization controls and gain unauthorized access to sensitive information. The vulnerability affects the Mogi component of the SpabRice product suite and represents a configuration-based security weakness rather than a code defect. The vulnerability carries a CVSS 3.1 score of 5.3 (medium severity) with a network-based attack vector requiring no special privileges or user interaction. The attack has low complexity and could result in limited confidentiality impact through unauthorized information disclosure, though integrity and availability are not affected. The FAUCET Risk Score of 32.0 out of 100 indicates moderate overall risk. There is currently no evidence of active exploitation in the wild, as indicated by the absence of the vulnerability from the Known Exploited Vulnerabilities (KEV) catalog and its inactive status on threat tracking lists. The extremely low EPSS score of 0.000370 suggests minimal probability of exploitation in the near term. Community attention appears limited at this time, though the configuration-based nature of this vulnerability warrants review of access control settings in affected deployments.