What is the CVSS score of CVE-2026-24368?

CVE-2026-24368 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Theme-one The Grid are affected by CVE-2026-24368?

A critical authorization flaw in Theme-one The Grid (versions below 2.8.0) allows attackers to bypass access controls and exploit misconfigured security settings, potentially exposing sensitive data…

How to fix or mitigate CVE-2026-24368?

Within 24 hours: Identify all systems running Theme-one The Grid and document current versions in use; immediately disable the plugin if business operations permit. Within 7 days: Implement network segmentation to restrict access to affected systems, apply WAF rules to monitor and block suspicious authorization requests, and audit access logs for signs of exploitation. Within 30 days: Develop an upgrade plan to version 2.8.0 or later once available, or identify and implement alternative solutions that provide equivalent functionality with proper security controls.

Theme-one The Grid CVE-2026-24368

MEDIUM

Missing Authorization (CWE-862)

2026-01-22 audit@patchstack.com

Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.8 (HIGH) 5.3 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 22, 2026 - 17:16 nvd

HIGH 8.8

DescriptionCVE.org

Missing Authorization vulnerability in Theme-one The Grid the-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Grid: from n/a through < 2.8.0.

AnalysisAI

Improper access control in Theme-one The Grid versions prior to 2.8.0 enables authenticated users to bypass authorization checks and gain unauthorized access to sensitive functionality. An attacker with valid credentials could exploit misconfigured security levels to read, modify, or delete data without proper permissions. No patch is currently available.

Technical ContextAI

Classified as CWE-862 (Missing Authorization). Affects Theme-one The Grid the-grid. Missing Authorization vulnerability in Theme-one The Grid the-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Grid: from n/a through < 2.8.0.