CVE-2026-39699

CVE-2026-39699 is a Missing Authorization vulnerability affecting massiveshift AI Workflow Automation (ai-workflow-automation-lite) through version 1.4.2, caused by incorrectly configured access control security levels that fail to properly restrict user permissions. The vulnerability has a CVSS v3.1 score of 5.3 (Medium severity) with a network-based attack vector requiring no authentication or user interaction, though the impact is limited to integrity violations with no confidentiality or availability concerns. Exploitation requires low attack complexity and could allow unauthorized users to modify system data or configurations. The vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and shows no signs of active exploitation in the wild, with minimal community attention reflected by its inactive status on security hot lists. The EPSS score of 0.00037 indicates this vulnerability is less frequently exploited than the vast majority of disclosed CVEs, suggesting limited immediate threat despite its authorization bypass nature.