CVE-2025-54714 describes a missing authorization vulnerability in Dylan James Zephyr Project Manager (versions up to 3.3.201). This vulnerability arises from incorrectly configured access control security levels, which may allow an attacker with low privileges to access or perform actions without proper authorization. The CVSS score of 7.1 reflects a high-severity issue exploitable over the network with low complexity and no user interaction required. No vendor advisory or patch information is currently available, and no known exploits have been reported.

The vulnerability can lead to unauthorized access to sensitive information or functionality within the Zephyr Project Manager, potentially compromising confidentiality (high impact), with limited integrity impact and no availability impact. Since the attack vector is network-based and requires low privileges, attackers with some access could exploit this to escalate their access or view restricted data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations in the affected versions of Zephyr Project Manager to mitigate unauthorized access risks. Monitor for vendor updates and apply patches promptly once available.