CVE-2026-65472 describes a missing authorization vulnerability (CWE-862) in Kit (formerly ConvertKit) affecting versions up to 3.3.5. The flaw allows unauthenticated attackers to bypass access controls, potentially modifying data or performing unauthorized actions. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or vendor remediation level is currently documented, and no known exploits have been observed.

The vulnerability allows unauthenticated attackers to bypass access controls, leading to potential unauthorized modification of data (integrity impact). There is no impact on confidentiality or availability. The medium CVSS score reflects the limited but meaningful integrity risk without requiring authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected Kit versions and monitor for unusual activity related to unauthorized access attempts. Follow vendor updates closely for any forthcoming patches or mitigation instructions.