This vulnerability affects zhayujie CowAgent versions 2.0 and 2.1.0. It is caused by missing authorization in an unknown function in channel/channel.py related to the Message Endpoint component. The flaw can be exploited remotely without user interaction and requires low privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. Although an exploit has been publicly released, no official patch or remediation has been provided by the vendor as of the publication date.

The missing authorization allows remote attackers with low privileges to perform unauthorized actions on the affected system. This could lead to partial compromise of confidentiality, integrity, and availability, but the impact is limited as indicated by the medium CVSS score and low complexity of attack. Since the exploit is public, there is an increased risk of exploitation, but no known active exploitation in the wild has been reported.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a patch is released, consider restricting network access to the affected component and applying compensating controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.