CVE-2026-22236 is a critical improper authentication flaw (CVSS 9.8) in the backend APIs of BLUVOYIX from Bluspark Global. An unauthenticated remote attacker could reach customer data and compromise the platform. The record names no fixed version, so contact the vendor for confirmation.
What's affected
BLUVOYIX, a product from Bluspark Global. The record gives no version range and no fixed version. It describes the flaw as present in the product itself, in the backend APIs.
The only reference is the vendor product page. Confirm affected and fixed builds with the vendor.
How to check if you're exposed
The record gives no version information, so there is no version check to run. If you are a BLUVOYIX customer, contact Bluspark Global and ask directly whether your tenant or deployment is affected and whether a fix has been applied.
If you host any part of the platform yourself, review web server logs for requests to the backend and admin API paths from addresses you do not recognise.
What to do now
- Contact Bluspark Global and ask for written confirmation of whether your instance is affected and what was changed.
- Ask whether customer data was accessed, and request any indicators the vendor can share.
- Restrict network access to backend and admin APIs to known addresses if your deployment allows it.
- Review accounts for any you did not create, and rotate credentials and API keys held in the platform.
- Add the vendor to your third party risk review so future advisories reach the right owner.
Why it matters
Improper authentication, tracked as CWE-287, means an API accepts requests it should have refused. The record says an unauthenticated remote attacker could send crafted HTTP requests to the vulnerable APIs and gain full access to customers' data.
A score of 9.8 reflects network access, low complexity, no privileges, no user interaction and high impact across confidentiality, integrity and availability. For a hosted platform that holds customer records, the main question for customers is whether their data was reached before the fix.
The record does not say the flaw is exploited in the wild, and it is not on the CISA KEV list. The vendor page is the only reference, so details are thin.
Quick check
What can an attacker do with this flaw?
According to the record, an unauthenticated remote attacker could gain full access to customers' data and compromise the targeted platform. It does not describe how.
Is a fixed version available?
The record does not name one. Ask the vendor and keep the answer in writing.
Sources
Last reviewed: 19 October 2026.
