The vulnerability CVE-2026-40784 affects FluentBoards up to version 1.91.2 and involves an authorization bypass caused by a user-controlled key. This occurs because access control security levels are improperly configured, allowing an attacker with low privileges to bypass authorization checks. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality and integrity with network attack vector, low attack complexity, and no user interaction required. No official fix or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could lead to unauthorized disclosure and modification of sensitive information within FluentBoards. The attacker requires low privileges and can perform the attack remotely without user interaction. Availability is not impacted. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to FluentBoards installations to trusted users and networks where possible. Monitor for updates from the vendor or security advisories for any forthcoming patches or mitigations.