The vulnerability identified as CVE-2025-49952 affects the Houzez product by favethemes, allowing authorization bypass through a user-controlled key due to misconfigured access control security levels. This flaw enables an attacker with low privileges to bypass intended authorization mechanisms, potentially impacting availability but not confidentiality or integrity. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and unchanged scope. The vulnerability affects versions up to 4.2.5.

The impact is limited to availability disruption, as indicated by the CVSS vector (Availability impact: High; Confidentiality and Integrity impact: None). An attacker with low privileges can exploit the authorization bypass to cause denial of service or other availability-related issues. There is no evidence of confidentiality or integrity compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided at this time. Users should monitor the vendor's communications for updates and apply any official fixes once available.