This vulnerability in Uasoft Badaso 3.0.0-alpha involves permission issues within the ApiRequest::class function of the File API component, specifically in src/Routes/api.php. The flaw allows remote attackers to manipulate permissions, potentially bypassing intended access controls. The vulnerability is exploitable remotely without requiring privileges or user interaction. Although the issue was reported to the project early, no remediation or patch has been provided to date. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

The vulnerability allows remote attackers to exploit permission issues in the API request handling, potentially enabling unauthorized access or actions within the affected system. Since no privileges or user interaction are required, this could lead to unauthorized data access or modification depending on the API's role. However, there is no evidence of active exploitation in the wild at this time.

No official fix or patch is currently available from the vendor. Users of Uasoft Badaso 3.0.0-alpha should consider avoiding use of this version in production environments until a vendor response or patch is released. Monitor the vendor's channels for updates and apply any official fixes once available.