This vulnerability in kodcloud KodExplorer affects the initInstall function in the systemMember.class.php controller file. By manipulating the 'path' argument, an attacker with high privileges can bypass authorization checks remotely, potentially gaining unauthorized access or performing unauthorized actions. The issue impacts all versions up to 4.52. The vendor has not provided a fix or advisory, and no patch links are available. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required for attack initiation, no user interaction, and limited impact on integrity.

Successful exploitation allows an attacker to bypass authorization mechanisms remotely, potentially leading to unauthorized access or actions within the KodExplorer application. The medium CVSS score reflects moderate impact, with limited integrity impact and no confidentiality or availability impact explicitly stated. There is no evidence of active exploitation in the wild at this time.

No official patch or remediation is currently available, and the vendor has not responded to the disclosure. Organizations using affected versions should consider restricting access to the vulnerable function or the application until a fix is released. Monitor vendor channels for updates and apply patches promptly once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.