The vulnerability identified as CVE-2025-32256 affects devsoftbaltic SurveyJS versions up to 1.12.20. It is caused by missing authorization checks, which allow unauthenticated users to access functionality that should be restricted by ACLs. According to the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), the attack can be performed remotely without privileges or user interaction, potentially leading to a denial of service or availability impact. No confidentiality or integrity impacts are indicated. The vulnerability is publicly disclosed but lacks vendor patch or mitigation details.

The impact is limited to availability, as unauthorized users may access functionality not properly constrained, potentially disrupting service. There is no impact on confidentiality or integrity. No known exploits have been reported in the wild, reducing immediate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to SurveyJS instances and monitor for unusual activity related to unauthorized access attempts. Avoid exposing SurveyJS services to untrusted networks if possible.