The vulnerability CVE-2026-28104 affects the Site Suggest product by Aryan Shirani Bid Abadi, specifically versions up to 1.3.9. It is caused by missing authorization checks, allowing unauthenticated users to access functionality that should be restricted by ACLs. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

An attacker can access certain functions without proper authorization, potentially leading to limited integrity and availability impacts. Confidentiality is not affected. The medium severity score reflects the potential for unauthorized actions that could disrupt service or modify data within the affected application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates and apply any official patches once available. Until then, restricting access to the affected application or implementing compensating access controls may reduce risk.