CVE-2026-39682

CVE-2026-39682 is a missing authorization vulnerability in linkPizza-Manager versions 5.5.5 and earlier, developed by Arjan Pronk. The flaw stems from incorrectly configured access control security levels that fail to properly restrict user permissions. The vulnerability carries a CVSS score of 5.3 (Medium severity) with a network-based attack vector requiring no user interaction or special privileges. The primary risk is confidentiality compromise, as an unauthenticated attacker can access sensitive information over the network, though integrity and availability are not impacted. There is no evidence of active exploitation at this time. The vulnerability does not appear on the Known Exploited Vulnerabilities catalog, has an extremely low EPSS score of 0.0004, and maintains an inactive status on security hotlists. Community attention remains minimal, though organizations running vulnerable versions should prioritize patching to eliminate unauthorized information disclosure risks.