The vulnerability CVE-2026-40786 affects Long Watch Studio's MyRewards plugin up to version 5.7.3. It is caused by missing authorization controls, which means that access control security levels are incorrectly configured, allowing users with limited privileges to perform unauthorized actions. The CVSS score is 4.3 (medium), reflecting low complexity and no user interaction required, but limited impact confined to integrity. No patch or official remediation has been published yet, and the product is not a cloud service, so remediation depends on vendor updates.

The impact is limited to integrity, as unauthorized users may be able to perform actions they should not be allowed to, potentially modifying data or system state improperly. There is no impact on confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should review and tighten access control configurations where possible and monitor for unusual activity related to MyRewards plugin usage. No official patch or workaround has been provided by the vendor as of now.