CVE-2026-22238 is a critical flaw (CVSS 9.8) in the admin APIs of BLUVOYIX from Bluspark Global. An unauthenticated remote attacker could create a new user with admin rights and log in as that user. The record names no fixed version, so confirm the fix with the vendor.
What's affected
BLUVOYIX, a product from Bluspark Global. The record gives no version range and no fixed version. It describes the flaw as present in the product itself, in the admin APIs.
The only reference is the vendor product page. Confirm affected and fixed builds with the vendor.
How to check if you're exposed
The record gives no version information, so there is no version check to run. If you are a BLUVOYIX customer, contact Bluspark Global and ask directly whether your tenant or deployment is affected and whether a fix has been applied.
If you host any part of the platform yourself, review web server logs for requests to the backend and admin API paths from addresses you do not recognise.
What to do now
- Contact Bluspark Global and ask for written confirmation of whether your instance is affected and what was changed.
- Ask whether customer data was accessed, and request any indicators the vendor can share.
- Restrict network access to backend and admin APIs to known addresses if your deployment allows it.
- Review accounts for any you did not create, and rotate credentials and API keys held in the platform.
- Add the vendor to your third party risk review so future advisories reach the right owner.
Why it matters
The weaknesses are CWE-269 and CWE-306: missing authentication for a critical function, and improper privilege management. Per the record, the admin API accepted a request to create a new admin user without checking who sent it. The attacker could then log in with that account.
That sequence turns one unauthenticated request into full control of the platform and its customer data. After any fix, the follow up work is to check the user list for accounts nobody on your side created.
The record does not say the flaw is exploited in the wild, and it is not on the CISA KEV list. The vendor page is the only reference, so details are thin.
Quick check
How would I spot a related compromise?
Look at the user list for admin accounts you did not create, and check logs for requests to the admin API. The record does not give indicators, so ask the vendor for any.
Is a fixed version available?
The record does not name one. Ask the vendor and keep the answer in writing.
Sources
Last reviewed: 19 October 2026.
