The GhostPool Aardvark Plugin suffers from a missing authorization vulnerability in versions up to 2.19. This issue arises from incorrectly configured access control security levels, allowing attackers without privileges to perform unauthorized actions that compromise the integrity of the system. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or vendor advisory is currently available to confirm remediation status.

Exploitation of this vulnerability can lead to unauthorized modification or manipulation of data or system functionality (integrity impact). There is no impact on confidentiality or availability. The vulnerability can be exploited remotely without authentication or user interaction, increasing its risk. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations for the Aardvark Plugin to prevent unauthorized actions. Monitor for vendor updates and apply patches promptly once available.