The vulnerability identified as CVE-2025-28965 affects the Md Yeasin Ul Haider URL Shortener product up to version 3.0.7. It is characterized by missing authorization checks in the 'exact-links' functionality, allowing unauthorized users to access features that should be restricted by ACLs. The CVSS 3.1 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts including low confidentiality, high integrity, and low availability impacts. There is no indication of an official patch or vendor advisory detailing remediation steps at this time.

This vulnerability allows attackers to bypass authorization controls and access or manipulate functionality that should be restricted. The impact includes potential unauthorized modification of data (high integrity impact), limited confidentiality loss, and minor availability impact. Exploitation could lead to unauthorized actions within the URL Shortener application, potentially compromising the integrity of shortened URLs or related data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to the URL Shortener application to trusted users only and consider implementing additional access controls at the network or application level to limit exposure. Monitor for vendor updates and apply patches promptly once released.