This vulnerability in Themeum Tutor LMS (up to version 3.9.13) involves an authorization bypass through a user-controlled key due to improperly configured access control security levels. The issue allows an attacker with limited privileges to escalate their access by exploiting the flawed authorization mechanism. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity and no user interaction, requiring low privileges. The impact is high integrity compromise without confidentiality or availability impact. No vendor advisory or patch information is currently available.

An attacker with low privileges can bypass authorization controls, potentially modifying or manipulating data or functionality that should be restricted. The vulnerability does not impact confidentiality or availability but poses a high integrity risk. There are no known exploits in the wild, and no official fixes have been announced.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Themeum's communications for updates. No vendor-provided mitigation or workaround information is currently available.