This vulnerability, identified as CVE-2026-65435, is a missing authorization issue (CWE-862) in Thrive Leads Version up to 10.9.2. It allows unauthenticated attackers to bypass access controls, resulting in potential integrity and availability impacts. The CVSS v3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and unchanged scope. No vendor advisory or patch information is available, and the product is not a cloud service.

The vulnerability can lead to unauthorized modification or disruption of the affected system's functionality (integrity and availability impacts). Confidentiality is not impacted. Since the vulnerability can be exploited without authentication, it poses a risk of unauthorized actions by remote attackers. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently available, users should monitor vendor communications for updates. Until a patch is released, consider restricting access to the affected component where possible to reduce exposure.