This vulnerability affects DevaslanPHP project-management up to version 2.0.0-beta1. The issue lies in the function KanbanScrumHelper::recordUpdated in app/Helpers/KanbanScrumHelper.php, where improper authorization allows an attacker with limited privileges to perform unauthorized actions remotely. The vulnerability does not require user interaction and has a CVSS 4.0 base score of 5.3, indicating medium severity. No official patch or remediation guidance has been published by the vendor as of the publication date.

An attacker with low privileges can remotely exploit this vulnerability to bypass authorization controls in the Ticket Handler component, potentially leading to unauthorized modifications or actions within the project management system. The exact impact depends on the privileges gained through this improper authorization but may affect data integrity or workflow processes.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a patch is released, restricting access to the affected function or component through network controls or application-level restrictions may help reduce risk. Avoid exposing the affected version to untrusted networks where possible.