This vulnerability in Omnisend's 'Newsletters, Email Marketing, SMS and Popups' product (versions <= 1.9.0) is an insecure direct object reference (IDOR) issue categorized under CWE-639. It allows an attacker with low privileges to bypass authorization by manipulating user-controlled keys, potentially leading to unauthorized actions or access. The CVSS 3.1 vector indicates the attack can be performed remotely with low complexity and no user interaction, but requires some privileges. Confidentiality and availability impacts are not present, but integrity impact is low.

An attacker with limited privileges could exploit this vulnerability to bypass authorization controls, potentially performing unauthorized actions that affect data integrity. There is no impact on confidentiality or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor Omnisend's official channels for updates. Until a fix is available, restrict privileges of users to the minimum necessary to reduce risk.