The vulnerability identified as CVE-2025-63028 affects shinetheme Traveler versions up to 3.2.6 and is due to missing authorization controls. This results in incorrectly configured access control security levels, permitting unauthorized users to perform unauthorized actions. The CVSS 3.1 base score is 5.3 (medium), with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, integrity impact, and no availability impact. No patch or remediation information is currently available, and the product is not a cloud service.

The impact is limited to integrity violations due to missing authorization checks, allowing unauthorized modification or actions within the affected Traveler product. There is no impact on confidentiality or availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected Traveler versions and monitor for unusual activity related to unauthorized actions. Avoid deploying affected versions in untrusted environments.