This vulnerability affects the DevaslanPHP project-management software up to version 2.0.0-beta1. Specifically, the function KanbanScrumHelper::recordUpdated in the file app/Helpers/KanbanScrumHelper.php improperly authorizes certain operations, allowing an attacker with low privileges to perform unauthorized actions remotely. The issue was reported early to the project but remains unaddressed. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no user interaction, and limited impact on confidentiality, integrity, and availability.

An attacker with low privileges can remotely exploit this vulnerability to perform unauthorized actions within the Ticket Handler component of the affected software. This improper authorization could lead to unauthorized modifications or access within the project management system. There are no known exploits in the wild, and the impact is limited to the affected version 2.0.0-beta1 of DevaslanPHP project-management.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates and consider restricting access to the affected component or applying compensating controls to limit exposure until a patch is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.