This vulnerability, identified as CWE-862 Missing Authorization, affects AcyMailing SMTP Newsletter versions up to 10.11.1. It allows subscribers to bypass access controls, potentially exposing sensitive information. The CVSS v3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, requiring low privileges and no user interaction, impacting confidentiality but not integrity or availability. No vendor advisory or patch information is provided, and no known exploits have been reported.

An attacker with subscriber-level privileges can bypass authorization controls, leading to unauthorized access to information. The confidentiality impact is high, but integrity and availability are not affected. This could result in exposure of sensitive subscriber or newsletter data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber privileges where possible and monitor for unusual access patterns related to subscriber accounts.