The vulnerability CVE-2026-39649 in themebeez Royale News up to version 2.2.4 is caused by missing authorization checks, resulting in incorrectly configured access control security levels. This allows unauthenticated attackers to perform unauthorized actions that impact data integrity. The CVSS 3.1 base score is 5.3 (medium), with network attack vector, low attack complexity, no privileges required, no user interaction, and no confidentiality or availability impact. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Exploitation of this vulnerability can lead to unauthorized modification of data within the Royale News application. There is no impact on confidentiality or availability. The medium severity score reflects the integrity impact and ease of exploitation without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review and tighten access control configurations where possible to limit unauthorized access. Monitor for vendor updates regarding patches or official mitigations.