This vulnerability (CVE-2025-49976) in WANotifier Notifier arises from missing authorization controls, allowing attackers with low privileges to potentially perform unauthorized actions due to incorrectly configured access control levels. The affected versions include all versions up to and including 2.7.12. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact is present. No vendor advisory or patch information is currently provided.

The vulnerability allows an attacker with low privileges to bypass authorization controls, potentially leading to unauthorized modification of data or system state (integrity impact). There is no impact on confidentiality or availability. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in WANotifier Notifier to ensure proper authorization enforcement. Monitor vendor communications for updates regarding patches or official mitigations.