This vulnerability in Gravitec.net – Web Push Notifications (up to version 2.9.17) arises from missing authorization checks caused by misconfigured access control security levels. An attacker with low privileges could exploit this to perform actions they are not authorized to do, impacting the integrity of the system. The CVSS score is 4.3 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impact limited to integrity.

Exploitation could allow an attacker with limited privileges to perform unauthorized actions, potentially modifying data or configurations within the affected component. There is no impact on confidentiality or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review and tighten access control configurations to ensure proper authorization enforcement within Gravitec.net – Web Push Notifications. Monitor for updates from the vendor regarding official patches or mitigations.