This vulnerability in NSquared Simply Schedule Appointments (<=1.6.12.4) is due to missing authorization checks caused by incorrectly configured access control security levels. This could permit unauthorized users to perform actions that should be restricted. The CVSS 3.1 base score is 6.5, with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact. No vendor advisory or patch information is provided, and the product is not a cloud service.

The vulnerability allows unauthorized users to perform certain actions due to missing authorization controls, potentially leading to limited integrity and availability impacts. Confidentiality is not affected. The medium CVSS score reflects these impacts. There are no known active exploits targeting this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in Simply Schedule Appointments to mitigate unauthorized access risks.