This vulnerability (CVE-2026-66452) is classified as CWE-862 (Missing Authorization) in the Legal Text Connector of the IT-Recht Kanzlei software. Versions up to 1.0.13 are affected. The flaw allows unauthenticated users to bypass access controls, potentially leading to unauthorized modification or disruption of service. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, but low integrity and high availability impacts. No vendor advisory or patch information is currently available.

The vulnerability allows unauthenticated attackers to bypass authorization controls, which can result in unauthorized integrity modifications and denial of service conditions. Confidentiality is not impacted. The medium severity score reflects the potential for integrity and availability impacts without requiring authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected component where possible and monitor for unusual activity related to the Legal Text Connector. Avoid exposing the vulnerable versions to untrusted networks.