This vulnerability in Sugar Calendar (Lite) versions up to 3.9.1 involves missing authorization controls, which means certain actions or resources may be accessible without proper permission checks. The issue stems from incorrectly configured access control security levels, allowing users with some privileges to perform actions they should not be authorized to do. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low attack complexity and requiring low privileges, but no user interaction. The impact is limited to integrity, with no confidentiality or availability impact noted.

The vulnerability allows an attacker with low privileges to perform unauthorized actions that could alter data integrity within Sugar Calendar (Lite). There is no impact on confidentiality or availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in Sugar Calendar (Lite) to ensure proper authorization enforcement. Monitor vendor channels for updates or patches addressing this vulnerability.