This vulnerability (CVE-2026-66661) affects Onokazu Directories Pro versions up to 2.0.5 and involves incorrect privilege assignment (CWE-266) that enables subscriber privilege escalation. The CVSS 3.1 vector indicates it is remotely exploitable over the network without user interaction, but requires high attack complexity and no privileges. The impact includes high confidentiality and integrity loss with low availability impact. No vendor advisory or patch information is currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker to escalate privileges from a subscriber level to a higher privilege level, potentially compromising sensitive data and system integrity. The confidentiality and integrity impacts are rated high, while availability impact is low. This could lead to unauthorized access or modification of protected resources within the affected application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. Avoid granting unnecessary privileges to subscriber accounts and consider additional access controls as a temporary measure.