This vulnerability (CVE-2024-37096) is classified as CWE-862 (Missing Authorization) and affects the Popup box product by the Popup Box Team. It arises from incorrectly configured access control security levels, potentially allowing unauthorized users with some privileges to perform actions they should not be authorized to execute. The CVSS v3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact. The affected versions are up to 4.5.1, but no patch or official remediation level has been published yet.

The impact is limited to integrity violations due to missing authorization checks. There is no confidentiality or availability impact. The vulnerability could allow an attacker with some privileges to perform unauthorized actions within the affected Popup box product. No known exploits are reported, and the vulnerability is not known to be actively exploited in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a fix is available, review and tighten access control configurations where possible to mitigate risk.