This vulnerability in SunnyKai AI Magic versions up to 1.0.4 is due to incorrect privilege assignment in the newsletter-page-redirects feature, which permits unauthorized privilege escalation. The CVSS 3.1 base score of 9.8 reflects network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix information is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation allows an attacker to escalate privileges on the affected system, potentially leading to full system compromise with high confidentiality, integrity, and availability impacts. This could enable unauthorized access to sensitive data and control over the affected application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected component and monitor for suspicious activity related to privilege escalation attempts. Avoid deploying vulnerable versions in production environments if possible.