The vulnerability CVE-2026-25368 in codepeople Calculated Fields Form is due to missing authorization checks, which allows users with limited privileges to bypass intended access controls. This affects versions up to and including 5.4.4.1. The CVSS 3.1 base score is 6.5 (medium severity), with an attack vector over the network, low attack complexity, requiring privileges but no user interaction, and impacts confidentiality but not integrity or availability. No vendor advisory or patch information is provided, and no exploits are known in the wild.

Successful exploitation could allow an attacker with some privileges to access or retrieve sensitive information that should be restricted, impacting confidentiality. There is no impact on data integrity or system availability reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations for the Calculated Fields Form plugin to limit exposure. Monitor for vendor updates and apply patches promptly once released.