CVE-2026-19376 is a permission-related vulnerability in Uasoft Badaso version 3.0.0-alpha, specifically in the ApiRequest::class function within the src/Routes/api.php file of the File API component. This vulnerability allows remote attackers to manipulate permissions, potentially leading to unauthorized access or actions. The issue was reported early to the project but remains unaddressed. The CVSS 3.1 base score is 7.3, indicating a moderate severity level. No patch or official fix is currently available, and public exploit details have been disclosed.

The vulnerability permits remote attackers to exploit permission issues without requiring privileges or user interaction, potentially leading to unauthorized information disclosure, modification, or denial of service. The moderate CVSS score reflects the significant but not critical impact. No known active exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the affected API endpoints or implementing additional access controls as a temporary mitigation.