CVE-2026-65525 describes an unauthenticated broken access control vulnerability (CWE-862) in the uxper Civi Framework affecting versions up to 2.2.0. This vulnerability allows attackers without authentication to bypass authorization mechanisms, potentially leading to unauthorized modification of data or actions within the application. The CVSS v3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

The vulnerability allows unauthenticated attackers to bypass authorization controls, leading to potential unauthorized integrity modifications within the affected application. There is no impact on confidentiality or availability. The medium CVSS score reflects the risk of integrity compromise without requiring authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigation or workaround is currently documented.