{"id":"CVE-2026-15219","kind":"vulnerability","aliases":["CVE-2026-15219"],"related":[],"title":"Costifier: authorization bypass lets users reach other users' data","description":"Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers.\n\nThis issue affects Costifier: through 2026-10-16.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Costifier, a product from SFM Software Technologies, trusts a user-controlled identifier when deciding who may access a resource. An attacker who can supply that identifier can get past the authorization check.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["costifier","sfm-software","vendor"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-16T09:17:04+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:57:53+00:00","updated_at":"2026-10-25T03:57:53+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-10-25T03:57:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Costifier: authorization bypass lets users reach other users' data","impact":"medium","summary":"Costifier, a product from SFM Software Technologies, trusts a user-controlled identifier when deciding who may access a resource. An attacker who can supply that identifier can get past the authorization check.","category":"vendor","nicknames":[],"who_cares":["costifier","sfm-software"],"confidence":0.4,"needs_auth":"unknown","worst_case":"attacker reaches data or actions belonging to other accounts","analyst_note":"Check the vendor's advisory and the NVD page for affected versions, the vulnerable endpoint, and whether a fixed release exists; the vendor did not respond to disclosure.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000503,"input_tokens":3319,"output_tokens":342,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-10':79C '-15219':12A,15A '-16':80C '-2026':11A,14A '2026':78C 'access':38B 'affect':75C 'allow':68C 'attack':42B 'author':2A,52B,54C 'bypass':3A,55C 'check':53B 'contact':85C 'control':32B,59C 'costifi':1A,16B,21B,67C,76C 'cve':10A,13A 'data':9A 'decid':35B 'disclosur':89C 'earli':86C 'exploit':69C 'get':49B 'identifi':33B,47B,72C 'inc':66C 'issu':74C 'key':60C 'let':4A 'may':37B 'note':81C 'past':50B 'product':23B 'reach':6A 'resourc':40B 'respond':93C 'sfm':18B,25B,63C 'sfm-softwar':17B 'softwar':19B,26B,64C 'suppli':45B 'technolog':27B,65C 'trust':28B,71C 'user':5A,8A,31B,58C 'user-control':30B,57C 'vendor':20B,83C 'vulner':61C 'way':96C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T09:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-15219","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15219","severity":null,"published_at":"2026-10-16T09:17:04+00:00","modified_at":"2026-10-16T15:21:12+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}