The Elastic Email Subscribe Form versions up to 1.2.2 suffer from a Missing Authorization vulnerability (CVE-2025-28985). This vulnerability arises from improperly configured access control, allowing an attacker with low privileges to perform unauthorized actions without user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

The vulnerability could allow an attacker with low privileges to perform unauthorized actions on the Elastic Email Subscribe Form, potentially impacting the integrity and availability of the service. There is no confidentiality impact reported. No known exploitation in the wild has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Elastic Email's advisories for updates. Until a fix is available, restrict access to the vulnerable component where possible and review access control configurations to mitigate unauthorized use.