This vulnerability in mjperpinosa stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be allows remote attackers to bypass authorization by manipulating the assignment_item_id parameter in an unknown function within the /PHP/objects/notes file, part of the Note Handler/Assignment Handler component. The exploit is publicly available. Due to the product's continuous delivery model with rolling releases, no explicit affected or fixed versions are provided. The vendor has not issued any advisory or patch at the time of this report.

Successful exploitation allows an unauthenticated remote attacker to bypass authorization controls, potentially gaining unauthorized access to note or assignment data managed by the vulnerable component. The impact is limited to the confidentiality and integrity of the affected component's data. There is no indication of privilege escalation or system-wide compromise from the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, monitor official channels for updates. Until a patch is available, consider restricting access to the affected functionality or implementing additional access controls as a temporary mitigation.