This vulnerability in kalcaddle kodbox 1.67 Build 02 involves improper authorization in the msgWarning plugin component, specifically in the /index.php?plugin/msgWarning/action file. An attacker can remotely manipulate requests to bypass authorization controls. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Exploit code is publicly available, but the vendor has not responded or provided a fix.

Successful exploitation allows remote attackers to bypass authorization controls in the affected plugin, potentially granting unauthorized access to functionality or data. There is no indication of privilege escalation, integrity, or availability impact beyond improper authorization. No known active exploitation in the wild has been reported.

No official fix or patch is currently available from the vendor, who has not responded to the disclosure. Users should monitor vendor channels for updates. In the meantime, restricting access to the affected endpoint or disabling the msgWarning plugin may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.