This vulnerability in LeadConnector arises from missing authorization checks, which means that certain actions or resources may be accessible without proper permission validation. The affected versions include all releases up to and including 3.0.21. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low attack complexity, no privileges required, and no user interaction needed. The impact is limited to integrity, with no confidentiality or availability impact reported. No vendor advisory or patch information is currently available.

An attacker can exploit the missing authorization to perform unauthorized actions that affect the integrity of the system or data. There is no impact on confidentiality or availability. Since no known exploits are in the wild, the immediate risk appears moderate but should be addressed to prevent potential misuse.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in LeadConnector to ensure proper authorization enforcement. Monitor vendor channels for updates or patches addressing this vulnerability.