The vulnerability CVE-2024-43120 in TypeSquare Webfonts involves missing authorization controls, meaning certain functions can be accessed without proper permission checks. This issue is classified under CWE-862 and affects versions through 2.0.7. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact. No vendor advisory or patch information is currently available, and the product is not a cloud service.

The impact is limited to unauthorized modification or manipulation of functionality within the affected product, potentially leading to integrity issues. There is no confidentiality or availability impact reported. Since no exploits are known in the wild, the immediate risk appears moderate but could increase if exploitation techniques emerge.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected TypeSquare Webfonts instances where possible and monitor for unusual activity related to unauthorized function access. Avoid exposing the service to untrusted networks if feasible.