This vulnerability in GravityView (<= 3.0.0) is an unauthenticated insecure direct object reference (IDOR) issue, categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). It allows attackers without any privileges to bypass authorization controls and access restricted data by manipulating user-controlled keys. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity, no privileges required, and no user interaction needed. Confidentiality impact is low, with no integrity or availability impact reported. No vendor advisory or patch information is currently available, and the vulnerability is not related to a cloud service.

An attacker can access restricted data without authentication by exploiting insecure direct object references. This leads to a confidentiality breach of potentially sensitive information. There is no reported impact on data integrity or system availability. The vulnerability affects data confidentiality but does not allow modification or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. No specific mitigation or workaround is currently documented.