## Summary
Vitals ESP (Galaxy Software Services) versions <= 6.3 contain an Incorrect Authorization issue (CVE-2026-4639). Authenticated remote attackers can invoke certain administrative functions and escalate privileges.
## Technical Details
- Vulnerability class: CWE-863 (Incorrect Authorization)
- Root condition (per advisory): authorization checks are insufficient for some administrative functions, allowing an authenticated attacker to perform actions beyond their intended privilege level.
- Attack prerequisites (per advisory): attacker must be authenticated and can reach the service over the NETWORK.
- Result: privilege escalation with high impact on confidentiality, integrity, and availability (per CVSS 8.8).
## Affected
- gss vitalsesp version <= 6.3
## Impact
- Privilege escalation via administrative function misuse
- High potential impact consistent with CVSS C:H/I:H/A:H (confidentiality, integrity, and availability)
## Mitigation
1. Contact the vendor to obtain the patch (TVN guidance).
2. Restrict network exposure of Vitals ESP to trusted management networks only, reducing the chance of authenticated remote access.
3. Review access logs for administrative function usage by accounts that should not have elevated privileges (TVN does not provide specific indicators beyond the administrative-function behavior).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-863