CVE-2026-3999
Broken Access Control in Specific Configurations Enables Privilege Escalation
Publication date: 2026-03-13
Last updated on: 2026-03-13
Assigner: ENISA
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pointsharp | id_server | to 9.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-3999 is a critical security vulnerability in the ID Server product versions prior to 9.0.0. It involves broken access control that allows an authenticated user to perform horizontal privilege escalation, meaning the user can gain unauthorized access to resources belonging to other users. This vulnerability only affects specific configurations.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an authenticated user to access resources that they should not have permission to access, potentially compromising sensitive data or functionality. Since it enables horizontal privilege escalation, it can lead to unauthorized access across user accounts, increasing the risk of data breaches or misuse of information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the risk of this vulnerability, customers are strongly advised to update their ID Server installations to version 9.0.0 or later immediately.
Support for applying the update or assessing exposure is available via Pointsharp’s support email and portal.