Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security… (CVE-2026-114175)

The DigitalME eRoom eroom-zoom-meetings-webinar component suffers from a missing authorization vulnerability (CWE-862) that permits exploitation due to incorrectly configured access control security levels. This issue affects versions up to and including 1.7.1. The vulnerability allows an attacker with low privileges (PR:L) to perform actions without proper authorization, impacting integrity and availability but not confidentiality. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, reflecting network attack vector, low attack complexity, and no user interaction required.

Exploitation of this vulnerability can lead to unauthorized modification or disruption of system functions (integrity and availability impacts). Confidentiality is not affected. The medium CVSS score reflects moderate risk due to the potential for integrity and availability impacts without requiring user interaction. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should monitor vendor communications for updates. Until a fix is available, carefully review and tighten access control configurations to prevent unauthorized access.