The sonaar MP3 Audio Player for Music, Radio & Podcast plugin suffers from a missing authorization vulnerability (CVE-2025-32235) in versions up to 5.9.4. This flaw allows attackers with limited privileges to bypass access control restrictions, potentially performing unauthorized actions that impact data integrity. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact. No vendor patch or advisory is currently available, and no exploits have been observed in the wild.

The vulnerability allows unauthorized modification or actions due to missing authorization checks, impacting the integrity of the affected system. Confidentiality and availability are not affected. The medium severity rating reflects the limited scope and impact of the issue. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations for the sonaar MP3 Audio Player plugin. Limit user privileges to the minimum necessary to reduce risk. Monitor for vendor updates regarding patches or official mitigations.