This vulnerability in the Miraculous Core Plugin arises from incorrectly configured access control security levels that can be bypassed using a user-controlled key. It affects all versions before 2.0.9. The flaw enables an attacker to perform authorization bypass remotely without authentication or user interaction, resulting in complete compromise of the affected system's confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.8, reflecting the critical nature of this issue.

Successful exploitation leads to full authorization bypass, allowing attackers to access and manipulate data or functionality that should be restricted. This results in high impact on confidentiality, integrity, and availability of the affected system. Given the network attack vector and no required privileges, the vulnerability poses a significant risk to any deployment of the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the Miraculous Core Plugin if possible. Monitor vendor channels for updates and apply any official patches promptly once available.