This vulnerability in Mikado-Themes Backpack Traveler (<= 2.10.3) involves an authorization bypass caused by improperly configured access control mechanisms. Specifically, the application allows an attacker with some privileges (low privileges) to bypass intended authorization checks by controlling a key used in the access control process. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity and no user interaction, requiring low privileges. The impact includes limited integrity and availability loss but no confidentiality impact. No patch or official remediation information is currently available.

An attacker with low privileges can exploit this vulnerability remotely to bypass authorization controls, potentially leading to unauthorized actions that affect the integrity and availability of the system. Confidentiality is not impacted. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigations are provided in the available data.