CVE-2025-9062 HIGH

CVE-2025-9062: IDOR in MeCODE Informatics' Envanty

Vendor Mecode Informatics And Engineering Services Ltd.
Product Envanty
Weakness CWE-639 · IDOR
Published February 19, 2026
Last update June 5, 2026
View on NVD All CVEs

CVSS base score

7.3/10
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Authorization Bypass Through User-Controlled Key vulnerability in MeCODE Informatics and Engineering Services Ltd. Envanty allows Parameter Injection. This issue affects Envanty: before 1.0.6.   NOTE: The vendor was contacted early about this disclosure but did not respond in any way. The vulnerability was learned to be remediated through reporter information and testing.

Key dates

02Disclosure timeline

February 19, 2026 CVE published
June 5, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-6976 Authorization Bypass Through User-Controlled Key in GitLab CVE-2023-49251 CVE-2026-48868 WordPress Simple Shopping Cart plugin <= 5.2.9 - Insecure Direct Object References (IDOR) vulnerability CVE-2024-8791 Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation CVE-2025-30254 Growatt Cloud portal Authorization Bypass Through User-Controlled Key