This vulnerability in kodcloud KodExplorer (up to version 4.52) involves an authorization bypass via the roleGroupAction function in the systemRole.class.php file. An attacker can manipulate the group_role parameter to circumvent access controls remotely. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability. The vendor has not provided a patch or remediation, and the exploit is publicly available.

Successful exploitation allows remote attackers to bypass authorization mechanisms, potentially granting unauthorized access to restricted functionality or data within KodExplorer. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts as per the CVSS vector. There are no confirmed reports of active exploitation in the wild.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the disclosure. Users should monitor vendor channels for updates. Until a fix is released, consider restricting network access to the affected KodExplorer instances and applying compensating controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.