This vulnerability, identified as CVE-2024-32507, concerns an incorrect privilege assignment flaw in the 'Login with phone number' component developed by Hamid Alinia. It affects all versions up to 1.7.16. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. The flaw could allow an attacker with some privileges to escalate or misuse privileges improperly. No patch or official fix information is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

The vulnerability allows incorrect privilege assignment, which can lead to unauthorized privilege escalation or misuse within the affected application. This impacts confidentiality, integrity, and availability of the system, potentially allowing attackers to gain elevated access or disrupt services. No known active exploitation has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should monitor official channels for updates. In the meantime, restrict access to the affected component where possible and review privilege assignments carefully to minimize risk.