This vulnerability, identified as CVE-2025-69179, involves incorrect privilege assignment (CWE-266) in Theme passion's Support Ticket Management System versions up to and including 1.9. It enables unauthenticated attackers to escalate privileges, potentially gaining unauthorized access and control over the system. The CVSS 3.1 base score of 9.8 reflects network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability. No patch or official remediation level has been provided as of the publication date.

Successful exploitation allows unauthenticated attackers to escalate privileges, leading to complete compromise of the Support Ticket Management System. This can result in unauthorized access to sensitive data, modification or deletion of information, and disruption of service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected system where possible and monitor for suspicious activity related to privilege escalation attempts.