The vulnerability CVE-2026-32376 in raratheme Kalon arises from missing authorization checks due to incorrectly configured access control security levels. It affects Kalon versions up to 1.2.9. The CVSS 3.1 base score is 5.3 (medium), with an attack vector of network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), low integrity impact (I:L), and no availability impact (A:N). This indicates that an unauthenticated attacker can exploit the vulnerability remotely to cause limited integrity damage.

Exploitation of this vulnerability can lead to unauthorized modification or manipulation of data or functionality within the affected Kalon product, impacting data integrity. There is no impact on confidentiality or availability. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is available, users should monitor vendor communications for updates. Until a fix is released, consider restricting network access to the affected application or implementing compensating controls to limit unauthorized access where feasible.