CVE-2026-5230: Improper Access Control in Mia Technologies' Pizzy Library

Synopsis

An improper access control vulnerability in MIA Technology Inc.'s Pizzy Library allows a network-accessible attacker to bypass authorization checks and access restricted resources. The flaw is reachable over the network and requires only a low-privilege account, with no victim interaction needed. Successful exploitation gives the attacker read access to sensitive data and limited ability to modify application state. A patched-image rebuild at version 1.3.9.26250 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker can send crafted requests from a remote host without requiring physical or local access.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need administrative or elevated credentials to trigger the access control bypass.

• Victim interactionNot required

  No user action is needed; the attacker can exploit the flaw entirely without involving another person.

• Attack complexityDetail

  Exploit complexity is low, meaning no special timing, race conditions, or environmental prerequisites are needed for the attack to succeed reliably.

Blast Radius

• A successful attacker reads sensitive application data that should be restricted to higher-privilege users, such as configuration details, user records, or internal API responses.
• The attacker can make low-impact writes or modifications within the application, limited by the scope of the misconfigured access control rules.
• No availability impact is introduced by this vulnerability; the service continues running during and after exploitation.