FairSketch Rise Ultimate Project Manager & CRM version 3.9.4 contains an insecure permissions vulnerability. This flaw allows a remote authenticated user to append comments or upload attachments to tickets without having proper view or edit authorization. The issue arises from missing authorization checks in the ticketing and commenting API.