The vulnerability identified as CVE-2025-26961 affects the Fresh Framework by FRESHFACE, where certain functionality is accessible without proper authorization checks enforced by ACLs. This missing authorization allows unauthenticated or unauthorized users to perform actions that should be restricted. The CVSS v3.1 base score is 8.6, indicating a high severity issue with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts including low confidentiality, high integrity, and low availability. The affected versions include all versions up to and including 1.70.0. There is currently no vendor advisory or patch information available, and no known exploits have been observed in the wild.

Successful exploitation of this vulnerability could allow attackers to access and perform unauthorized operations within the Fresh Framework, potentially compromising data integrity and causing limited availability impact. Confidentiality impact is rated low, but integrity impact is high, meaning attackers could alter data or system state improperly. Availability impact is low, indicating limited disruption to service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Fresh Framework to trusted users and networks only. Monitor for unusual activity related to unauthorized access attempts. Avoid exposing the affected versions publicly where possible.