The vulnerability CVE-2026-39657 affects leadlovers forms up to version 1.0.2 and is due to missing authorization checks, resulting in incorrectly configured access control. This flaw allows unauthenticated attackers to perform actions that should require authorization, impacting the integrity of the system. The CVSS score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity. No official patch or remediation guidance has been published by the vendor yet.

Exploitation of this vulnerability could allow unauthorized users to perform actions that modify data or system state without proper authorization, affecting the integrity of the leadlovers forms application. There is no impact on confidentiality or availability reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review and tighten access control configurations where possible to limit unauthorized access. Monitor official leadlovers communications for updates and apply patches promptly once released.