This vulnerability affects 1024-lab smart-admin versions up to 3.30.0 and involves improper access controls in an unspecified function within the /smart-admin-api/druid/index.html file of the Demo Site component. The flaw allows remote attackers to bypass intended access restrictions without requiring privileges or user interaction. The vulnerability was reported early to the project but remains unaddressed, and public exploit details have been disclosed. The CVSS 4.0 base score is 6.9, indicating a medium severity level with network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation could allow remote attackers to access functionality or data that should be restricted, potentially leading to unauthorized information disclosure or limited unauthorized actions within the affected component. The exact impact is limited by the low and limited integrity and availability impacts indicated by the CVSS vector. No known active exploitation in the wild has been reported.

No official fix or patch is currently available from the vendor, and the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates and consider implementing compensating controls such as restricting access to the affected endpoint if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.