This vulnerability in Mikado-Themes Verdure versions up to 1.6 involves an authorization bypass caused by improper access control configuration. Specifically, the application allows a user to manipulate a key that controls authorization, bypassing intended security restrictions. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but integrity and availability impacts. No patch or vendor advisory is provided, and the product is not a cloud service.

An attacker with low privileges can exploit this vulnerability remotely to bypass authorization controls, potentially leading to unauthorized modification or disruption of the application. Confidential data confidentiality is not affected, but integrity and availability of the application may be compromised. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in Verdure to prevent user-controlled keys from bypassing authorization. Monitor for vendor updates and apply patches promptly once released.