The vulnerability identified as CVE-2025-49969 affects Zara 4 Image Compression versions up to 1.2.17.2. It arises from missing authorization checks, which means that certain operations can be performed without proper access control validation. The CVSS 3.1 score is 4.3 (medium), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, and impact limited to availability. No patch or vendor advisory has been published to date, and the product is not a cloud service.

The impact is limited to availability, meaning an attacker with low privileges could cause a denial of service or disrupt the normal operation of the Zara 4 Image Compression software. There is no impact on confidentiality or integrity according to the CVSS vector and description. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is currently documented, users should monitor vendor communications for updates. Until a fix is available, restricting access to the affected software to trusted users only may reduce risk.