CVE-2023-45892 is a high severity (CVSS 7.5) access control flaw in Floorsight Insights Q3 2023. The order and invoice pages can be viewed by an unauthenticated remote attacker, exposing sensitive customer information. Neither the record nor the write-up we read names a fixed version, so restrict access and ask the vendor.
What's affected
The record names Floorsight Insights, listed under the vendor Floorsight Software, in the Q3 2023 release. The public write-up linked from the record says the affected versions are "Q3 2023 and below" and states there are no version numbers. It names no fixed version and no mitigation.
The description is short. The Order and Invoice pages let an unauthenticated user view customer information. The write-up attributes this to missing access controls on those pages, which is an insecure direct object reference. A sibling record, CVE-2023-45893, covers the same behaviour in the Floorsight Customer Portal.
The NVD record scores it 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The weakness class is CWE-639 (authorization bypass through user-controlled key). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
There is no package to query, because this is a hosted or installed business application. Find out whether your organisation runs Floorsight Insights and which quarterly release it is on. Ask your vendor contact or look at the product version page.
Then test your own deployment from outside your network, without logging in, and see whether order or invoice pages respond with customer data. Do this only on systems you own or are authorised to test, and stop as soon as you have your answer. Check web server logs for unauthenticated requests to those pages from unfamiliar addresses.
What to do now
- Confirm with Floorsight whether your release is affected and whether a fixed build exists. The advisory we read does not say.
- Put the application behind a VPN, an allow list or single sign-on at the network edge until the vendor confirms a fix.
- Review access logs for requests to the order and invoice pages that did not carry a session.
- If customer data may have been read, follow your breach assessment process and your legal notification duties.
- Record the product and version in your inventory so the next advisory is easy to match.
Why it matters
The weakness is an authorization bypass through a user-controlled key (CWE-639). The application uses an identifier from the request to pick which record to show, and does not check whether the caller is allowed to see it. When the caller does not even need to log in, anyone who can reach the page can read other customers' data.
This class of bug is common because it does not need clever input. It is a missing check, and it is easy to miss in review. The fix is to enforce authentication and per-record authorization on the server for every request.
Quick check
Does this need a login?
No. The record describes an unauthenticated remote attacker, and the vector shows no privileges and no user interaction.
Is there a patch?
The sources we read do not name one. Contact the vendor and treat the pages as exposed until they confirm.
Sources
Last reviewed: 19 October 2026.
