The vulnerability CVE-2026-22396 affects Mikado-Themes Fiorello theme (versions up to 1.0) and involves an authorization bypass through a user-controlled key due to misconfigured access control security levels. This allows an attacker with some privileges to escalate their access by circumventing intended authorization mechanisms. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and low availability impact. There is no vendor advisory or patch information available at this time.

The impact includes limited integrity and availability loss due to authorization bypass, potentially allowing attackers to perform unauthorized actions within the affected Fiorello theme environment. Confidentiality is not impacted. The vulnerability requires the attacker to have some privileges and can be exploited remotely without user interaction. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigations or workarounds are documented at this time.