This vulnerability affects waooAI waoowaoo versions 0.4.0 and 0.4.1 in the stablePublicIdFromStorageKey function located in src/lib/media/hash.ts of the Media Handler component. Improper authorization occurs due to manipulation of the storageKey argument, which could allow an attacker to bypass authorization checks remotely. The attack complexity is high, and the exploitability is considered difficult. No privileges or user interaction are required for exploitation. Although the vulnerability has been publicly disclosed, the vendor has not issued a patch or official remediation at this time.

Successful exploitation could allow an attacker to bypass authorization controls related to media handling, potentially accessing or manipulating media resources without proper permissions. The impact is limited by the high complexity required to exploit and the lack of privileges needed. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. Until a fix is available, restrict access to the affected component where possible and apply compensating controls to limit exposure.