This vulnerability, identified as CWE-639 (Authorization Bypass Through User-Controlled Key), exists in Formidable Forms Signature Online Contract Automation versions <= 2.0.1. It allows unauthenticated attackers to exploit insecure direct object references, bypassing authorization mechanisms by controlling keys used to access objects. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

An attacker can gain unauthorized access to sensitive information by exploiting the IDOR vulnerability without needing authentication. This compromises confidentiality but does not affect integrity or availability of the system. The vulnerability poses a significant risk to data privacy for affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected application and monitor for suspicious activity related to object references. Avoid exposing sensitive object keys in URLs or client-side code where possible.