What is the CVSS score of CVE-2026-32427?

CVE-2026-32427 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Vw Education Lite are affected by CVE-2026-32427?

CVE-2026-32427 presents moderate security risk, a missing authorization vulnerability rated CVSS 5.3. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-32427?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Vw Education Lite CVE-2026-32427

EUVD-2026-11959 MEDIUM

Missing Authorization (CWE-862)

2026-03-13 Patchstack

Authentication Bypass Vw Education Lite

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11959

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in vowelweb VW Education Lite vw-education-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Education Lite: from n/a through <= 2.2.0.

AnalysisAI

VW Education Lite versions 2.2.0 and earlier contain a missing authorization vulnerability (CWE-862) that allows unauthenticated attackers to modify data through incorrectly configured access control security levels. An attacker with network access can exploit this vulnerability without requiring authentication or user interaction to perform unauthorized modifications, resulting in integrity compromise but not confidentiality or availability impact. The CVSS 5.3 medium score reflects the network-accessible nature and lack of authentication requirements, though the integrity-only impact limits the overall severity.

Technical ContextAI

This vulnerability represents a failure in access control implementation within the vowelweb VW Education Lite application, classified under CWE-862 (Missing Authorization). The root cause involves security levels that are either not properly enforced or incorrectly configured at the application layer, allowing requests that should be denied to proceed with modification capabilities. This type of vulnerability typically occurs when role-based access control (RBAC) or attribute-based access control (ABAC) mechanisms fail to validate user permissions before processing state-changing operations, or when default permissions are overly permissive. The affected product is identified through the vendor vowelweb and application name vw-education-lite, affecting versions through 2.2.0 where authorization checks are apparently missing from critical endpoints.

RemediationAI

Upgrade VW Education Lite to a patched version beyond 2.2.0 as soon as it becomes available from vowelweb. Contact the vendor directly or monitor their official security advisory channels for release of version 2.2.1 or later containing the authorization fix. As an interim mitigation while awaiting patches, implement network-level access controls to restrict unauthenticated access to the VW Education Lite application, deploy a Web Application Firewall (WAF) configured to block requests attempting state-modifying operations without proper authorization tokens, and review application logs for evidence of unauthorized modification attempts. Additionally, implement role-based access control enforcement at the application layer to ensure all endpoints validate user permissions before processing requests, and consider running VW Education Lite in an isolated network segment accessible only to authenticated and trusted users.