The vulnerability CVE-2026-57375 in FluxBuilder MStore API arises from missing authorization controls, allowing unauthorized access due to incorrectly configured access control security levels. This affects all versions up to and including 4.18.4. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates that the vulnerability is remotely exploitable over the network without privileges or user interaction, with low attack complexity. The impact includes limited confidentiality and integrity loss but no availability impact. No vendor advisory or patch information is currently available, and the vulnerability is not related to a cloud service.

Exploitation of this vulnerability could allow an unauthenticated attacker to bypass access controls in the MStore API, leading to limited unauthorized disclosure and modification of data. There is no impact on system availability. The medium CVSS score reflects the potential for information leakage and integrity compromise without requiring user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations on the MStore API to prevent unauthorized access. Monitor for vendor updates regarding patches or official mitigations.