This vulnerability in Mikado-Themes Innovio (<= 1.7) involves an authorization bypass through a user-controlled key due to misconfigured access control security levels. The issue allows a user with high privileges to circumvent intended authorization mechanisms, impacting confidentiality and integrity to a limited extent. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges are high, no user interaction needed, and unchanged scope. No patch or official remediation information is currently available.

The vulnerability could allow an attacker with high privileges to bypass authorization controls, potentially leading to limited unauthorized access or modification of data within the Innovio product. There is no indication of availability impact or widespread exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in Innovio to prevent misuse of user-controlled keys. Monitor for vendor updates or patches addressing this issue.