The vulnerability CVE-2026-39639 affects redpixelstudios RPS Include Content (versions up to 1.2.2) and is caused by missing authorization checks. This results in incorrectly configured access control security levels, which could allow an attacker with low privileges to access content without proper authorization. The CVSS 3.1 base score is 6.5, reflecting a network-based attack vector with low complexity and no user interaction required. Confidentiality impact is high, while integrity and availability impacts are none. No official remediation or patch information is currently available.

An attacker with low privileges can exploit this vulnerability remotely to gain unauthorized access to sensitive content due to missing authorization controls. The confidentiality of data is at risk, but integrity and availability are not impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations for RPS Include Content to ensure proper authorization enforcement. Monitor vendor channels for updates or patches addressing this vulnerability.