This vulnerability in Themeum Tutor LMS arises from missing authorization checks, which means that certain actions or resources may be accessible without proper permission validation. The affected versions include all releases up to 3.9.5. The CVSS vector indicates the attack can be performed remotely over the network with low complexity and requires low privileges but no user interaction. The impact is limited to confidentiality loss, with no integrity or availability impact reported. No vendor advisory or patch links are provided, and the product is not a cloud service.

The vulnerability allows an attacker with low privileges to access sensitive information without proper authorization, leading to a confidentiality breach. There is no reported impact on data integrity or system availability. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is provided in the available data, users should monitor Themeum's official channels for updates. Until a fix is released, restricting access to the affected Tutor LMS installation and reviewing user permissions may help reduce risk.