The vulnerability identified as CVE-2025-39553 affects the Church Admin software by andy_moyle, specifically versions up to 5.0.9. It is categorized as a missing authorization issue, meaning that certain operations or data may be accessible without proper permission checks. The CVSS 3.1 base score is 4.3, with the vector indicating network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, and limited confidentiality impact. No patch or vendor advisory details are currently available.

An attacker with low privileges could exploit this missing authorization vulnerability to gain unauthorized access to certain data or functions within the Church Admin application. The impact is limited to confidentiality loss; integrity and availability are not affected. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and restrict user privileges carefully to minimize exposure. Monitor for any vendor updates or patches addressing this issue.