This vulnerability in Mikado-Themes Roam (<= 2.1.1) involves an authorization bypass through a user-controlled key due to misconfigured access control security levels. An attacker with high privileges can exploit this flaw to gain unauthorized access or perform actions beyond their intended permissions. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and low impact on confidentiality and integrity, with no impact on availability.

The vulnerability allows an attacker with high privileges to bypass authorization controls, potentially leading to unauthorized access or modification of data within the affected application. The impact is limited to low confidentiality and integrity loss, with no availability impact. No known exploits have been reported, and the vulnerability affects versions up to 2.1.1 of Mikado-Themes Roam.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations to prevent misuse of user-controlled keys. Monitor for vendor updates regarding patches or official mitigations.