This vulnerability in kalcaddle kodbox 1.67 Build 02 involves improper authorization in the msgWarning plugin component, specifically in the /index.php?plugin/msgWarning/action file. An attacker can remotely exploit this flaw without authentication or user interaction to bypass authorization controls. The vendor was notified but did not respond, and no patch or remediation guidance is currently available. Exploit code has been published publicly, increasing the risk of exploitation.

Successful exploitation can lead to unauthorized actions within the affected plugin, potentially allowing attackers to bypass authorization restrictions remotely. The CVSS 4.0 base score is 6.9 (medium), indicating a significant but not critical impact. There is no indication of privilege escalation, data confidentiality loss, or integrity compromise beyond improper authorization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to the affected endpoint or applying compensating controls until a patch is released.