The vulnerability CVE-2025-31867 in JoomSky JS Job Manager (<= 2.0.2) allows an attacker to bypass authorization controls by exploiting incorrectly configured access control security levels through a user-controlled key. This issue enables privilege escalation or unauthorized actions due to improper enforcement of access restrictions. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.

Successful exploitation could allow an attacker with some privileges to perform unauthorized actions or access functionality beyond their intended permissions, potentially leading to limited integrity and availability impacts. There is no evidence of confidentiality compromise. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations in JS Job Manager to prevent unauthorized privilege escalation. Monitor vendor channels for updates and apply patches promptly once available.