CVE-2026-97070: Authorization Bypass Through User-Controlled Key in CozyThemes Cozy Blocks

This vulnerability in CozyThemes Cozy Blocks (cozy-addons) allows an attacker to bypass authorization controls by exploiting improperly configured access control security levels through a user-controlled key. The issue affects all versions prior to 2.2.24. No known exploits are reported in the wild. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality.

An attacker can bypass authorization mechanisms, potentially gaining unauthorized access to functionality or data within Cozy Blocks. The impact is limited to the scope of the authorization bypass and is rated medium severity. There is no indication of privilege escalation, confidentiality, integrity, or availability impact beyond the bypass itself.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor CozyThemes advisories for updates addressing this vulnerability.