This vulnerability (CWE-862) in RedNao Smart Forms involves missing authorization controls, allowing users with some level of privilege to execute actions they should not be authorized to perform. It affects all versions up to 2.6.91. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low privileges required and no user interaction needed, resulting in integrity impact but no confidentiality or availability impact. No official patch or fix has been disclosed by the vendor as of the publication date.

The impact is limited to integrity, meaning unauthorized users could modify data or perform unauthorized actions within the Smart Forms application. There is no impact on confidentiality or availability reported. Since no known exploits exist in the wild, the immediate risk appears moderate but could increase if exploitation techniques emerge.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should review user privileges carefully and restrict access to trusted users only. Monitoring for unusual activity related to Smart Forms usage may help detect attempts to exploit this vulnerability.