Vulnerability · Published Mar 16, 2026 · Assigned by INCIBE

CVE-2026-3020Identity based authorization bypass vulnerability (IDOR) in the Wakyma application web

High 8.6

In plain English

A high-severity authorization bypass via user-controlled key in Wakyma application web from Wakyma. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.2%top 85.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Identity based authorization bypass vulnerability (IDOR) that allows an attacker to modify the data of a legitimate user account, such as changing the victim's email address, validating the new email address, and requesting a new password. This could allow them to take complete control of other users' legitimate accounts

Affected products (as reported)

Vendor	Product	Versions
Wakyma	Wakyma application web	all versions

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wakyma-application-web patch