Uncanny Automator CVE-2026-120846

The CVSS vector (AV:N/AC:L/PR:N/UI:N) implies remote, unauthenticated exploitation of Uncanny Automator versions up to and including 7.7.1, but the specific plugin feature, endpoint, or configuration that exposes the missing authorization check is not described in the available sources. The description references 'Incorrectly Configured Access Control Security Levels', suggesting the impact may depend on how access-control levels are configured in a given deployment, though the exact triggering configuration is not specified. Limiting factors: impact is confined to integrity (I:L) with no confidentiality or availability effect, and the precise unauthorized action an attacker can perform is unverified from the supplied data.

This is a moderate-severity Missing Authorization flaw (CWE-862) with a CVSS 3.1 base score of 5.3 (vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The vector indicates network-reachable, low-complexity exploitation requiring no privileges and no user interaction, but the impact is narrow: integrity-only and rated Low, with no confidentiality or availability impact. The vuln.today decision label is 'this_month' rather than act_now or emergency, consistent with a real-but-not-urgent issue. No EPSS score, no CISA KEV listing, and no confirmed proof-of-concept are present in the supplied data, so there is no signal of active or imminent widespread exploitation - the single reference is the Patchstack database advisory, not verified exploit code. The signals are internally consistent (broad reachability, limited impact), so this reads as a genuine but lower-priority hardening fix rather than a high-CVSS-but-illusory issue; the main limitation is that the description does not identify the specific affected endpoint or action, so the concrete integrity effect cannot be scoped from the available data.

A remote attacker sends a request directly to an access-control-protected function of the Uncanny Automator plugin that fails to verify the caller's authorization, performing an action or modifying data they should not be able to. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is needed, but the impact is limited to integrity (I:L) with no data disclosure or outage. No verified public exploit code is present in the supplied data; the only reference is the Patchstack advisory.