CVE-2026-24611 is an unauthenticated broken access control vulnerability (CWE-862) affecting MetForm Pro versions <= 3.9.1. The flaw allows attackers without authentication to bypass authorization mechanisms, potentially leading to unauthorized access to sensitive data and disruption of service. The CVSS v3.1 score is 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and availability impact. No official patch or remediation guidance is currently available from the vendor, and no known exploits have been reported in the wild.

Successful exploitation of this vulnerability can result in unauthorized access to sensitive information and denial of service conditions due to the broken access control. Since the vulnerability is exploitable without authentication, it poses a significant risk to affected systems and their data confidentiality and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the MetForm Pro plugin and monitor for unusual activity. Avoid exposing the vulnerable versions to untrusted networks where possible.