CVE-2026-102915: CWE-862 Missing Authorization in Marco van Wieren WPO365

This vulnerability is a missing authorization (broken access control) issue in WPO365 versions up to 44.1. It allows an attacker with low privileges to access or perform actions beyond their authorization scope, potentially leading to high confidentiality impact and limited integrity impact. The CVSS vector indicates the attack can be performed remotely over the network without user interaction, requiring low privileges. No official patch or remediation details are provided in the available data.

An attacker with low privileges can exploit this vulnerability remotely to gain unauthorized access to sensitive information or functionality, resulting in a high confidentiality breach and some integrity impact. There is no impact on availability. The vulnerability could lead to data exposure or unauthorized actions within the affected WPO365 environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to the affected WPO365 versions and review user privileges to minimize potential exploitation.