The vulnerability identified as CVE-2024-50490 in lowcage PegaPoll versions up to 1.0.2 is due to missing authorization checks, allowing unauthorized access to protected functionality. The CVSS 3.1 base score of 9.8 reflects that an unauthenticated attacker can remotely exploit this issue without user interaction, resulting in complete compromise of confidentiality, integrity, and availability. The vulnerability arises from improper enforcement of ACLs, permitting access to sensitive operations or data that should be restricted. No vendor patch or advisory has been published yet, and the product is not a cloud service, so remediation depends on vendor updates.

An attacker can remotely access and use functionality in PegaPoll that should be restricted, leading to full compromise of confidentiality, integrity, and availability of the affected system. This could allow unauthorized data access, modification, or disruption of service. Given the critical CVSS score and lack of required privileges or user interaction, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the PegaPoll application to trusted users and networks only. Monitor for unusual activity related to PegaPoll functionality. Avoid exposing the affected versions to untrusted networks. Follow vendor communications closely for updates on official patches or mitigations.