CVE-2026-65504 in Box Now Delivery Croatia Plugin
Summary
by MITRE • 08/06/2026
Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability identified as unauthenticated broken access control in BOX NOW Delivery Croatia versions up to 3.3.0 represents a critical security flaw that undermines the application's authorization mechanisms. This type of weakness falls under the Common Weakness Enumeration category CWE-284 which specifically addresses improper access control vulnerabilities. The issue allows attackers to bypass authentication requirements and gain unauthorized access to protected resources within the delivery management system, potentially compromising sensitive operational data and user information.
The technical flaw manifests through inadequate validation of user credentials and session management within the mobile application. Attackers can exploit this vulnerability by crafting specific API requests or manipulating application parameters without proper authentication tokens or credentials. The weakness likely stems from insufficient input validation, improper session handling, or missing authorization checks in the application's backend services. This allows malicious actors to access delivery tracking information, customer data, and potentially manipulate delivery statuses or routes without legitimate authorization.
The operational impact of this vulnerability extends beyond simple data exposure to encompass potential service disruption and business integrity compromise. Attackers could access confidential delivery information including customer addresses, order details, and personal identifiers, creating significant privacy risks. The vulnerability may also enable unauthorized modification of delivery assignments, potentially causing logistics disruptions or enabling fraudulent activities. Organizations relying on BOX NOW Delivery Croatia for their operations face increased risk of data breaches, regulatory non-compliance, and reputational damage when such access control failures exist in their systems.
Mitigation strategies should focus on implementing robust authentication mechanisms with proper session management and comprehensive input validation. Security patches should address the specific authorization bypass conditions through code-level fixes that enforce strict access controls and validate all user credentials before granting system access. Organizations must conduct thorough security assessments of their mobile applications, implement proper API rate limiting, and establish monitoring systems to detect unauthorized access attempts. The remediation process should align with industry standards such as those outlined in the OWASP Mobile Top 10 and NIST cybersecurity frameworks, ensuring that access control mechanisms are properly implemented and regularly tested for vulnerabilities. Regular security audits and penetration testing should be conducted to verify that authorization controls remain effective against evolving threat landscapes.