This vulnerability in SoliClub allows an attacker to bypass authorization controls by manipulating a user-controlled key, resulting in unauthorized access to embedded sensitive data. It affects SoliClub versions prior to 4.4.0 on iOS and 5.2.1 on Android. The issue stems from missing authorization validation, classified under CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-862 (Missing Authorization). The CVSS 4.0 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

Successful exploitation can lead to unauthorized retrieval of sensitive embedded data within the SoliClub application, potentially compromising user privacy and data confidentiality. The vulnerability allows attackers to bypass authorization mechanisms without any privileges or user interaction, increasing the risk of data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using vulnerable versions of SoliClub. Monitor vendor communications for updates on patches or mitigations.