This vulnerability affects kodcloud KodExplorer up to version 4.52 and involves an authorization bypass in the roleGroupAction function of the systemRole.class.php file. By manipulating the group_role argument, an attacker can bypass authorization controls remotely. The vulnerability was disclosed publicly with available exploit code, but the vendor has not issued any patch or official remediation. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows an attacker to bypass authorization mechanisms in KodExplorer, potentially gaining unauthorized access to restricted functions or data. The impact is rated medium based on the CVSS 4.0 score of 5.3, reflecting limited but meaningful compromise potential. There are no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing compensating controls such as restricting access to the affected functionality or limiting network exposure of KodExplorer instances until an official patch or update is released.