This vulnerability (CVE-2026-28155) in Do Lasso allows an attacker to bypass authorization controls by exploiting an Insecure Direct Object Reference (IDOR) flaw. The issue arises because user-controlled keys are used to access objects without proper authorization checks, enabling unauthorized access to certain resources or actions. The vulnerability is unauthenticated, meaning no prior login is required to exploit it. It affects Do Lasso versions up to 358. The CVSS 3.1 base score is 6.5, indicating a medium severity level. No vendor advisory or patch information is available at this time.

An attacker can bypass authorization controls without authentication, potentially leading to unauthorized actions or access to resources. The impact includes integrity and availability loss, but confidentiality is not affected according to the CVSS vector. This could disrupt normal operations or allow unauthorized modifications.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations are documented.