CVE-2026-39664

CVE-2026-39664 is a Missing Authorization vulnerability affecting Leadrebel versions 1.0.2 and earlier that allows attackers to exploit incorrectly configured access control security levels. The flaw enables unauthorized users to bypass authentication mechanisms and access restricted resources or functionality within the application. The vulnerability has a CVSS score of 5.3 (Medium severity) with a network-based attack vector requiring no special privileges or user interaction. However, the impact is limited to confidentiality breaches, as the vulnerability does not permit data modification or service disruption. The EPSS score of 0.00037 indicates this threat has lower probability of exploitation compared to the general CVE population. There is currently no evidence of active exploitation, and this vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog. Community interest appears minimal, with the FAUCET risk score of 32.0 reflecting limited threat actor attention. Organizations running Leadrebel should prioritize patching to versions above 1.0.2, though immediate emergency response is not warranted given the moderate risk profile.