This vulnerability (CVE-2026-57676) in Simple User Avatar by Matteo Manna involves an authorization bypass through a user-controlled key, classified under CWE-639 (Authorization Bypass Through User-Controlled Key). It allows attackers with low privileges to access resources or functions that should be restricted due to improperly configured access control security levels. The affected versions include all releases up to and including 4.9. There is no official patch or remediation level provided at this time, and no known exploits in the wild have been reported.

The vulnerability allows an attacker with low privileges to bypass authorization controls, potentially gaining unauthorized access to certain data or functionality. The impact is limited to confidentiality loss (partial information disclosure) without affecting integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the affected component and reviewing access control configurations to mitigate potential exploitation.