This vulnerability in SupportCandy (PSM Plugins) is an IDOR issue where user-controlled keys can bypass authorization checks, allowing unauthorized access to subscriber information. The CVSS vector indicates the attack can be performed remotely over the network with low complexity and requires only low privileges, without user interaction. The impact primarily affects confidentiality with some impact on integrity and availability. No vendor advisory or patch information is provided, and the affected versions are not explicitly stated but described as SupportCandy versions up to 3.4.6.

An attacker with low privileges can exploit this vulnerability remotely to gain unauthorized access to subscriber data, compromising confidentiality. The integrity and availability impacts are low but present. This could lead to data exposure and potential misuse of subscriber information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access privileges to trusted users only and monitor for unusual access patterns related to subscriber data. Avoid exposing user-controlled keys in requests where possible.