This vulnerability in zhayujie CowAgent up to version 2.1.0 is due to missing authorization checks in an unspecified function of the Message Endpoint component (channel/channel.py). The flaw enables remote attackers to perform unauthorized actions. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity, with network attack vector, low complexity, no privileges required, and no user interaction needed. Despite early notification, the vendor has not issued a patch or official remediation. A public exploit is available, which may facilitate exploitation.

The missing authorization vulnerability allows remote attackers to bypass access controls and potentially perform unauthorized operations on affected CowAgent instances. This could lead to unauthorized access or manipulation of the system's messaging endpoints. The presence of a public exploit increases the likelihood of exploitation in the wild, although no confirmed active exploitation is reported.

No official fix or patch is currently available from the vendor. Users of zhayujie CowAgent versions 2.0 and 2.1.0 should consider restricting network access to the affected service to trusted sources only and monitor for suspicious activity. Stay alert for vendor updates or patches addressing this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.