CVE-2026-1597 | Bdtask SalesERP up to 20260116 Administrative Endpoint ci_session improper authorization

A vulnerability categorized as critical has been discovered in Bdtask SalesERP up to 20260116. This issue affects some unknown processing of the component Administrative Endpoint. Such manipulation of the argument ci_session leads to improper authorization.

This vulnerability is listed as CVE-2026-1597. The attack may be performed from remote. In addition, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.