This vulnerability involves missing authorization checks in the WebToffee Accessibility Toolkit by WebYes (versions <= 2.0.4). Due to improperly configured access control, an attacker with low privileges can exploit the issue remotely without user interaction to gain unauthorized access to certain features or data. The CVSS 3.1 base score is 4.3, reflecting limited confidentiality impact and no integrity or availability impact. No official patch or vendor advisory is currently provided, and no known exploits have been reported.

The vulnerability allows unauthorized access due to missing authorization controls, potentially exposing limited confidential information. There is no impact on data integrity or availability. The medium severity score reflects the moderate risk posed by this issue given the low complexity and network attack vector but limited impact scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in the affected versions to prevent unauthorized access. Monitor vendor channels for updates or patches addressing this vulnerability.