This vulnerability (CVE-2025-48127) affects the App Cheap Push notification for Mobile and Web app through version 2.0.3. It is caused by missing authorization checks, resulting in incorrect access control configurations. The CVSS 3.1 base score is 6.5 (medium), reflecting that an unauthenticated attacker can exploit the issue over the network without user interaction, causing limited confidentiality and integrity impacts but no availability impact. No known exploits are reported in the wild. The product is not a cloud service, and no vendor advisory or patch information is currently available.

Exploitation of this vulnerability could allow an unauthenticated attacker to bypass access controls, leading to limited unauthorized disclosure or modification of data within the affected app. There is no impact on system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected app where possible and monitor for unusual activity related to push notification features. Avoid exposing the vulnerable versions publicly if feasible.