This vulnerability in RepairBuddy (<= 4.1132) involves broken access control where subscriber-level authorization checks are missing or insufficient. An attacker with low privileges can access subscriber functionalities without proper authorization, potentially leading to unauthorized data disclosure. The CVSS vector indicates the attack can be performed remotely over the network with low complexity and no user interaction, impacting confidentiality but not integrity or availability. No known exploits are reported in the wild, and no official fix or patch has been documented.

The vulnerability allows unauthorized access to subscriber features, resulting in a confidentiality breach. There is no impact on integrity or availability according to the CVSS vector. This could expose sensitive subscriber information to unauthorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected RepairBuddy versions and monitor for suspicious activity related to subscriber access. Avoid granting unnecessary privileges to users who do not require subscriber-level access.