CVE-2025-49375 describes a missing authorization vulnerability in cozythemes HomeLancer versions up to 1.0.1. The flaw arises from incorrectly configured access control security levels, allowing users with some privileges to access or modify resources beyond their authorization. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network attack vector, low attack complexity, requires privileges, no user interaction, unchanged scope, and impacts confidentiality and integrity. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

The vulnerability can lead to unauthorized access or modification of data within the HomeLancer application by users with limited privileges, impacting confidentiality and integrity. There is no reported impact on availability. No known exploits in the wild have been documented, suggesting limited or no active exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates and apply any future patches promptly. In the meantime, review and tighten access control configurations where possible to limit exposure.