The vulnerability CVE-2025-31755 in josselynj pCloud Backup arises from missing authorization controls, enabling exploitation of incorrectly configured access control security levels. Affected versions include all releases up to and including 1.0.1. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact is present. No official patch or vendor advisory is available to confirm remediation status.

An attacker with low privileges can exploit the missing authorization to perform unauthorized actions that affect the integrity of the pCloud Backup system. There is no impact on confidentiality or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for unusual activity related to access control misuse. Avoid granting unnecessary privileges to users of pCloud Backup.