This vulnerability (CWE-862) in Team Plugins360 All-in-One Video Gallery involves missing authorization controls, allowing users with limited privileges to perform unauthorized actions or access restricted data. It affects all versions up to 3.5.2. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, limited confidentiality impact, and no impact on integrity or availability. The product is cloud-hosted, and remediation is managed by the vendor. No public exploit is known.

An attacker with low privileges can exploit this missing authorization to gain unauthorized access to certain features or data within the All-in-One Video Gallery plugin. The impact is limited to confidentiality with no effect on integrity or availability. There are no reports of exploitation in the wild.

Since this is a cloud-hosted service, the vendor manages remediation and typically applies patches server-side. A patch is available according to the data, but no specific patch details are provided. Users should consult the vendor advisory for confirmation and ensure their service is updated to the latest secure version. No additional action is indicated at this time.