This vulnerability (CVE-2026-57676) in Matteo Manna Simple User Avatar involves an authorization bypass caused by user-controlled keys, classified under CWE-639 (Authorization Bypass Through User-Controlled Key). It affects versions up to 4.9 and allows attackers with some privileges to bypass access controls due to incorrect configuration. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, and limited confidentiality impact.

The vulnerability allows an attacker with low privileges to bypass authorization controls, potentially gaining unauthorized access to certain functionalities or data. The impact is limited to confidentiality loss without integrity or availability effects. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, monitor vendor communications for updates. Avoid relying on the affected versions until a patch or mitigation is provided.