CVE-2025-23971 describes a missing authorization vulnerability in whassan KI Live Video Conferences software versions up to 5.5.15. The issue arises from incorrectly configured access control security levels, allowing unauthorized users to perform actions without proper permissions. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low attack complexity, no privileges required, and no user interaction needed. The impact affects integrity but not confidentiality or availability. No patch or mitigation details are currently provided by the vendor, and the product is not a cloud service.

The vulnerability allows unauthorized users to perform actions that should be restricted, potentially leading to unauthorized modification or manipulation within the KI Live Video Conferences application. There is no impact on confidentiality or availability. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the affected versions where possible and monitor for updates from whassan regarding patches or workarounds.