The vulnerability identified as CVE-2026-24950 affects themeplugs Authorsy versions up to 1.0.6. It involves an authorization bypass caused by improper access control configuration, specifically through a user-controlled key. This flaw allows attackers to circumvent normal authorization checks without requiring privileges or user interaction. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. No vendor patch or advisory details are provided, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to bypass authorization controls and access sensitive information or functionality that should be restricted. The impact is limited to confidentiality compromise, with no integrity or availability effects reported. There are no known active exploits in the wild, but the vulnerability poses a high risk due to ease of exploitation and potential data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review and tighten access control configurations in Authorsy to prevent unauthorized key manipulation. Monitoring for unusual access patterns related to authorization bypass attempts is advisable. No official patch or workaround is currently documented.