This vulnerability (CVE-2025-8887) affects Aybs Interaktif by allowing an attacker with limited privileges to bypass authorization controls via manipulation of user-controlled keys. This results in missing authorization checks and exposure of sensitive information to unauthorized users. The vulnerability enables attack vectors including forceful browsing, parameter injection, and input data manipulation. The CVSS 3.1 base score is 6.1 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, indicating local attack vector with low complexity, requiring low privileges and no user interaction, impacting confidentiality highly, integrity partially, and no impact on availability. The affected version is 2024, and the vulnerability is publicly disclosed as of October 2025. No patch or vendor advisory is currently available.

An attacker with local access and low privileges can exploit this vulnerability to bypass authorization controls and gain unauthorized access to sensitive information. The confidentiality impact is high, integrity impact is low, and availability is not affected. This could lead to unauthorized disclosure of sensitive data within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is available, users should monitor vendor communications for updates. Until a fix is released, restrict local access to trusted users only and consider additional access control measures to limit exposure.