This vulnerability in NSquared Simply Schedule Appointments (versions up to 1.6.9.15) arises from missing authorization controls due to misconfigured access control security levels. This could allow an attacker to bypass intended access restrictions, leading to unauthorized information disclosure or modification. The CVSS 3.1 base score is 6.5 (medium), with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity but not availability. No patch or vendor advisory details are currently available.

The impact includes potential unauthorized access to sensitive information and unauthorized modification of data within the Simply Schedule Appointments application. There is no indication of availability impact. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in Simply Schedule Appointments to ensure proper authorization enforcement. Monitor for vendor updates regarding patches or official mitigations.