CVE-2026-27543 describes an unauthenticated privilege escalation vulnerability in FluxBuilder's MStore API versions up to 4.20.0. The issue is due to incorrect privilege assignment (CWE-266), allowing attackers without prior authentication to escalate privileges. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to escalate privileges within the MStore API, potentially gaining unauthorized access and control over sensitive data and system functions. The impact includes full compromise of confidentiality, integrity, and availability of the affected system components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the MStore API and monitor for suspicious activity related to privilege escalation attempts.