Themify Builder versions up to 7.6.7 suffer from a missing authorization vulnerability that results from incorrectly configured access control security levels. This allows users with some privileges to bypass intended restrictions, leading to unauthorized modification capabilities. The vulnerability does not affect confidentiality or availability but impacts data integrity. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and unchanged scope.

The vulnerability allows an attacker with limited privileges to perform unauthorized actions within Themify Builder, potentially modifying data or configurations without proper authorization. There is no impact on confidentiality or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to Themify Builder to trusted users only and monitor for unusual activity related to privilege escalation or unauthorized changes.