Description

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T15:17:14.697Z",
  "pubdate": "2026-08-06T15:17:14.697Z",
  "executiveSummary": "An unauthenticated broken access control vulnerability has been identified in the BOX NOW Delivery Croatia plugin and service implementations for versions <= 3.3.0.\nThis security defect allows remote, unauthenticated threat actors to bypass authorization boundaries and potentially access sensitive system functionalities or data restricted to privileged users.\nThe affected systems comprise BOX NOW Delivery Croatia software versions 3.3.0 and prior.\nThe risk implications include unauthorized access to application endpoints, potential data exposure, and manipulation of delivery or administrative mechanisms without requiring valid user credentials.\nAttacker capabilities involve network-based exploitation vectors to interact directly with insecurely configured endpoints.\nExploitation requirements are minimal, as the flaw lacks authentication controls, enabling seamless interaction from remote threat actors over the network without prerequisite privileges.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient access control enforcement mechanisms within the application routing or endpoint validation logic.\nSpecifically, sensitive functions lack proper authentication checks and role-based access validation, permitting arbitrary callers to invoke restricted controller actions or API endpoints.\nThe vulnerable component resides within the BOX NOW Delivery Croatia package for versions <= 3.3.0, specifically impacting modules responsible for handling operational requests without verifying the identity or authorization level of the requester.\nAuthentication requirements are entirely absent, classifying the flaw as an unauthenticated vector.\nPrivilege requirements are nonexistent, as any standard network user or anonymous actor can issue requests to the targeted endpoints.\nNetwork exposure is external, assuming the vulnerable service or application interface is accessible via standard HTTP/HTTPS protocols over the web.\nThe attack flow proceeds as follows: 1) The threat actor identifies the unprotected application endpoints associated with the BOX NOW Delivery Croatia implementation. 2) The attacker crafts malicious HTTP requests directed at these sensitive endpoints, omitting any authentication tokens or session identifiers. 3) The application processes the incoming request due to the absence of access control validations. 4) The server executes the underlying business logic or returns sensitive data to the unauthorized requester.\nPayload behavior typically involves parameter manipulation within the HTTP request to interact with backend functions improperly exposed by the broken access control implementation.\nPost-exploitation impact includes unauthorized retrieval of application data, potential modification of system settings, or improper execution of administrative operations, depending on the breadth of functionality exposed by the affected endpoints."
}