This vulnerability in NSquared Simply Schedule Appointments (<=1.6.11.11) arises from missing authorization checks, allowing attackers to bypass access controls. The issue stems from incorrectly configured access control security levels, which could permit unauthorized users to access or modify data they should not have permission to. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates the vulnerability is remotely exploitable without privileges or user interaction, with low attack complexity and impacts confidentiality and integrity but not availability. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation must be managed by the user.

Successful exploitation could lead to unauthorized disclosure and modification of data within the Simply Schedule Appointments application. The vulnerability does not affect availability. Since no exploits are known in the wild, the immediate risk may be limited, but the medium severity score reflects the potential impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently available, users should monitor vendor communications for updates. Until a patch is released, restrict access to the application to trusted users and networks where possible to reduce exposure.