This vulnerability (CVE-2024-43916) in Dylan James Zephyr Project Manager allows an attacker with some privileges to bypass authorization controls by manipulating user-controlled keys. It affects versions through 3.3.102. The weakness is categorized as CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 3.1 score is 4.3 (medium), with attack vector network, low attack complexity, requiring low privileges and no user interaction, impacting integrity but not confidentiality or availability. No patch or official remediation level has been published by the vendor at this time.

The vulnerability could allow an attacker with limited privileges to perform unauthorized actions by bypassing authorization checks, potentially leading to integrity violations within the affected application. There is no impact on confidentiality or availability reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor vendor communications for updates. Until a patch is available, restricting access to trusted users and minimizing privileges may reduce risk.