This vulnerability (CVE-2026-54840) in Tribulant Software Newsletters (versions <= 4.13) is classified as CWE-862: Missing Authorization. It allows unauthenticated attackers to bypass access controls, potentially leading to unauthorized access or modification of newsletter-related functionality. The CVSS 3.1 score of 7.3 reflects network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. The vendor has not yet provided a patch or official remediation guidance, and no known exploits have been reported.

Successful exploitation could allow unauthenticated attackers to perform actions or access data that should be restricted, impacting confidentiality, integrity, and availability of the affected system. The exact scope of impact depends on the specific functionality exposed by the broken access control in the Newsletters product. No known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Newsletters installation where possible and monitor for unusual activity related to newsletter management. Avoid exposing the affected versions publicly if feasible.