The vulnerability CVE-2026-103065 in Themeum Kirki is caused by improper validation of specified quantity in input, which results in access to functionality that is not properly constrained by ACLs. This means that unauthorized users may be able to access or invoke functions that should be restricted. The affected versions include all versions from 0 up to but not including 6.3.2. The CVSS v3.1 score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

An attacker can remotely exploit this vulnerability without any privileges or user interaction to gain unauthorized access to certain functionalities within Themeum Kirki. The confidentiality impact is high, meaning sensitive information could be exposed. Integrity impact is low, and availability is not affected. This could lead to unauthorized disclosure of information or partial compromise of the system's confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Themeum's official channels for updates. Until a fix is available, consider restricting access to the affected Kirki versions or applying compensating controls to limit exposure.