The vulnerability CVE-2026-25459 affects uixthemes Sober versions up to 3.5.12 and is characterized by missing authorization checks. This results in incorrectly configured access control security levels, which could allow an attacker with some privileges (low privileges required) to perform unauthorized actions that modify data integrity. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

The impact is limited to integrity as unauthorized modifications may be possible due to missing authorization checks. Confidentiality and availability are not affected. The vulnerability requires the attacker to have some privileges on the system and can be exploited remotely over the network. There are no reports of exploitation in the wild.

Patch status is not yet confirmed — no official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor advisory for updates and apply any official fixes once released. Until then, review and tighten access control configurations to minimize risk.