This vulnerability (CVE-2026-66464) in Toast Plugins' Internal Link Optimiser (versions <= 5.2.7) is due to missing authorization controls. It allows unauthenticated users to bypass access restrictions, potentially leading to unauthorized information disclosure or modification. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

The vulnerability allows unauthenticated attackers to bypass access controls, potentially leading to limited confidentiality and integrity impacts. There is no reported impact on availability. The medium severity score reflects these impacts and the ease of exploitation due to no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for unusual activity related to Internal Link Optimiser. Avoid exposing the plugin to untrusted networks or users.