CVE-2025-48133 describes a missing authorization vulnerability in Uncanny Owl's Uncanny Automator plugin (versions ≤ 6.4.0.2). The issue arises from incorrectly configured access control security levels, allowing unauthorized actions that impact integrity and availability without requiring privileges or user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) reflects network attack vector, low attack complexity, no privileges or user interaction needed, unchanged scope, no confidentiality impact, but limited integrity and availability impact. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

The vulnerability allows attackers to perform unauthorized actions due to missing authorization checks, potentially affecting the integrity and availability of the Uncanny Automator plugin. Confidentiality is not impacted. The medium CVSS score reflects these limited but meaningful impacts. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is available, users should monitor vendor communications for updates. Until a fix is released, consider restricting access to the plugin's administrative interfaces and review access control configurations to minimize exposure.