The vulnerability identified as CVE-2026-32340 affects the raratheme Business One Page plugin up to version 1.3.2. It is caused by missing authorization checks due to incorrectly configured access control security levels. This flaw allows unauthorized users to potentially perform actions without proper permission. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact. No patch or official fix has been documented, and the product is not a cloud service, so remediation depends on vendor updates.

The impact is limited to unauthorized modification or manipulation of data (integrity impact), with no confidentiality or availability impact reported. Because no privileges or user interaction are required, an attacker can exploit this vulnerability remotely over the network. However, no known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting access to the affected plugin or disabling it if possible may reduce exposure.