OpenCode Systems OC Messaging and USSD Gateway version 6.32.2 contains a critical improper access control vulnerability (CVE-2025-70614) with CVSS score 8.1. The vulnerability allows authenticated low-privileged users to access SMS messages outside their authorized tenant scope via crafted company or tenant identifier parameters. The flaw affects communications infrastructure deployed worldwide and was identified and patched within 24 hours by OpenCode Systems with version 6.33.11 released on January 6, 2026. The vulnerability was reported by Hussein Amer to CISA.