This vulnerability in CM Pop-Up banners arises from missing authorization checks caused by misconfigured access control security levels. Affected versions include all releases up to and including 1.8.4. The CVSS 3.1 base score is 4.3 (medium), reflecting a network attack vector with low complexity and requiring low privileges but no user interaction. The impact is limited to partial confidentiality loss, with no integrity or availability impact. There is no vendor advisory or patch information available at this time.

An attacker with low privileges could exploit this missing authorization to access or perform actions beyond their intended permissions, potentially leading to limited information disclosure. There is no indication of impact on data integrity or system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations where possible to limit exposure. Monitor for updates from CreativeMindsSolutions regarding patches or official mitigations.