This vulnerability (CVE-2026-57645) in Tribulant Software Newsletters (versions <= 4.13) is a broken access control issue classified under CWE-862. It allows unauthorized users to perform actions that require authorization within the newsletters_subscribers functionality. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) indicates the attack can be performed remotely with low attack complexity and no privileges, requiring user interaction. The impact affects integrity and availability but not confidentiality. There is no vendor advisory or patch available at this time.

The vulnerability can lead to unauthorized modification or disruption of newsletter subscriber data or functionality, impacting the integrity and availability of the affected system. Confidentiality of data is not impacted. Exploitation does not require privileges but does require user interaction. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected Newsletters component and monitor for suspicious activity related to subscriber management. Avoid exposing the newsletters_subscribers functionality to untrusted users.