The vulnerability identified as CVE-2026-27091 affects UiPress lite up to version 3.5.09. It involves missing authorization controls, meaning that access control mechanisms are improperly configured or absent, allowing users with limited privileges to perform actions or access data beyond their authorization. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates that the vulnerability is remotely exploitable over the network with low attack complexity, requires low privileges, no user interaction, and impacts confidentiality, integrity, and availability to a limited extent. No patch or official remediation guidance is currently available from the vendor.

Successful exploitation of this vulnerability could allow an attacker with low privileges to bypass access controls, potentially leading to unauthorized disclosure, modification, or disruption of data or functionality within UiPress lite. The impact is rated medium based on the CVSS score of 6.3. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review and tighten access control configurations where possible and limit privileges to trusted users only. Monitor vendor communications for updates on patches or official mitigations.