This vulnerability (CVE-2026-66634) in Pantherius Modal Survey is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). It affects versions up to 2.0.2.2.3 and allows an attacker with limited privileges to bypass authorization controls by manipulating a user-controlled key, resulting in unauthorized access to subscriber information. The CVSS v3.1 score is 4.3 (medium severity) with network attack vector, low attack complexity, requiring privileges, no user interaction, and limited confidentiality impact. No known exploits are reported in the wild, and no official remediation or patch information is currently provided.

The vulnerability allows an attacker with some level of privileges to bypass authorization checks and access subscriber data that should be restricted. The confidentiality impact is limited, with no impact on integrity or availability. This could lead to unauthorized disclosure of subscriber information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor vendor communications for updates and consider restricting access privileges to minimize risk until a fix is available.