What is the CVSS score of CVE-2026-32408?

CVE-2026-32408 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Brizy are affected by CVE-2026-32408?

Organizations using Missing Authorization vulnerability in themefusecom Brizy brizy should be aware of moderate risk from CVE-2026-32408, a missing authorization vulnerability rated CVSS 4.3.

How to fix or mitigate CVE-2026-32408?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Brizy CVE-2026-32408

EUVD-2026-11925 MEDIUM

Missing Authorization (CWE-862)

2026-03-13 Patchstack

Authentication Bypass Brizy

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11925

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization vulnerability in themefusecom Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through <= 2.7.23.

AnalysisAI

Brizy through version 2.7.23 contains a missing authorization flaw that allows authenticated users to access resources or perform actions beyond their assigned permissions due to improperly configured access controls. An attacker with valid credentials can exploit this vulnerability to view sensitive information from other users or accounts. No patch is currently available for this issue.

Technical ContextAI

This vulnerability is classified under CWE-862 (Missing Authorization), which represents a failure to properly enforce permission checks at the application logic layer. Brizy is a visual page builder plugin/platform that manages user roles and access control for website content and design elements. The root cause stems from inadequately validated access control decisions when processing user requests—the application likely fails to verify whether an authenticated user has the requisite permissions before returning resource data or allowing modifications. This is distinct from authentication failures; the user is already authenticated (PR:L indicates login is required), but the authorization layer does not properly validate role-based or permission-based access rules. The affected CPE would be cpe:2.3:a:themefusecom:brizy:* for versions through 2.7.23, indicating a systematic authorization bypass across the Brizy application.

RemediationAI

Upgrade Brizy to version 2.7.24 or later as soon as feasible to obtain the authorization control fix (consult the official Brizy release notes at brizy.io or the WordPress plugin repository for exact patch availability and timing). If immediate patching is not possible, implement compensating controls: restrict Brizy access via network IP allowlisting to trusted administrator ranges, enforce strong authentication policies (require multi-factor authentication for all Brizy user accounts), audit and minimize the number of user accounts with Brizy access, and implement application-level logging and monitoring to detect suspicious cross-user data access patterns. For WordPress deployments, consider temporarily disabling Brizy if it is not actively in use, and ensure all other plugins and WordPress core are updated to their latest versions to prevent account compromise vectors that could amplify this authorization bypass.