ERA404 StaffList versions up to 3.2.7 suffer from a missing authorization vulnerability (CVE-2025-32232) that allows exploitation of improperly configured access control security levels. The vulnerability permits users with low privileges to perform actions that should require higher authorization, impacting the integrity of the system without affecting confidentiality or availability. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low attack complexity and no user interaction required. No patch or remediation guidance is currently available from the vendor or advisory sources.

The vulnerability allows unauthorized modification or actions within the StaffList application by exploiting missing authorization controls. The impact is limited to integrity loss, with no confidentiality or availability impact reported. There are no known active exploits in the wild, reducing immediate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations where possible to limit exposure. Monitor for vendor updates regarding patches or official mitigations.