This vulnerability in REBUILD versions 4.4.0 through 4.4.11 arises from missing authorization checks in the /commons/file-editor-save component. By manipulating the url/fileKey parameter, an attacker can bypass authorization controls remotely. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Exploit code has been publicly released, increasing the risk of exploitation. The vendor has not issued any response or patch to date.

An attacker can remotely exploit this vulnerability to bypass authorization controls in the affected REBUILD versions, potentially allowing unauthorized access or modification of resources handled by the /commons/file-editor-save endpoint. The availability of public exploit code increases the likelihood of attacks. However, no further details on the exact impact or extent of compromise are provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, users should monitor official channels for updates and consider restricting access to the vulnerable endpoint if possible.