CVE-2026-22237 is a critical flaw (CVSS 9.8) in BLUVOYIX from Bluspark Global, where internal API documentation is exposed to the internet. An unauthenticated attacker could use it to reach and abuse internal functions. The record names no fixed version, so confirm the status with the vendor.
What's affected
BLUVOYIX, a product from Bluspark Global. The record gives no version range and no fixed version. It describes the flaw as present in the product itself, in the documentation for its internal APIs.
The only reference is the vendor product page. Confirm affected and fixed builds with the vendor.
How to check if you're exposed
The record gives no version information, so there is no version check to run. If you are a BLUVOYIX customer, contact Bluspark Global and ask directly whether your tenant or deployment is affected and whether a fix has been applied.
If you host any part of the platform yourself, review web server logs for requests to the backend and admin API paths from addresses you do not recognise.
What to do now
- Contact Bluspark Global and ask for written confirmation of whether your instance is affected and what was changed.
- Ask whether customer data was accessed, and request any indicators the vendor can share.
- Restrict network access to backend and admin APIs to known addresses if your deployment allows it.
- Review accounts for any you did not create, and rotate credentials and API keys held in the platform.
- Add the vendor to your third party risk review so future advisories reach the right owner.
Why it matters
The weakness is CWE-200, exposure of sensitive information. Here the exposed item is API documentation, which tells a stranger which endpoints exist and how they behave. The record says an unauthenticated remote attacker could use the APIs described in it to damage the platform by abusing internal functionality.
Documentation is not a bug by itself. The risk comes from the internal endpoints it describes being reachable without proper checks, which is why this record scores 9.8. Publishing API docs and keeping them behind login is a common review item for any team that ships an API.
The record does not say the flaw is exploited in the wild, and it is not on the CISA KEV list. The vendor page is the only reference, so details are thin.
Quick check
Is an exposed API doc really critical?
Here the record says the documented internal APIs could be called by an unauthenticated attacker. The exposure plus the reachable functions is what drives the score.
Is a fixed version available?
The record does not name one. Ask the vendor and keep the answer in writing.
Sources
Last reviewed: 19 October 2026.
