CVE-2026-5228: Improper Access Control in Kurt Software Studio's WriteUp Mobile App

Synopsis

An improper access control vulnerability affects Kurt Software Studio's WriteUp Mobile App, impacting versions 1.3.0 through 04062026. The flaw is reachable over the network by any authenticated user with a low-privilege account, requiring no additional interaction from other users. Successful exploitation gives an attacker full read, write, and availability impact within the application scope. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as the upstream maintainer publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WriteUp Mobile App service over the network; local or physical access is not required.

• AuthenticationRequired

  Any low-privilege account is sufficient; no admin or elevated credentials are needed to trigger the access control bypass.

• Victim interactionNot required

  The attacker does not need any action from another user to exploit this vulnerability.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or environmental constraints that must be satisfied.

Blast Radius

• Reads application data the authenticated user is not authorized to access, including data belonging to other users or restricted functional areas.
• Writes or modifies application records and content beyond the attacker's authorized scope.
• Disrupts application availability, potentially rendering the service unusable for legitimate users.
• Accesses application functionality gated by access control lists, bypassing role or permission enforcement entirely.