The vulnerability in the Ribblr:Crotchet and Knitting iOS application allows an authenticated user to bypass the application’s intended authorization controls, enabling them to perform actions that should be reserved for higher‑privilege users. The weakness is classified as CWE‑639, indicating that an attacker can alter the role or permission context of an authenticated user. While it does not provide arbitrary code execution or denial of service, the impact includes unauthorized data disclosure, content modification, or other privileged actions that compromise the integrity and confidentiality of the application data.

The affected product, as identified by the CNA, is the Ribblr:Crotchet and Knitting iOS application. No specific version information is provided in the advisory, so all releases of the app could be affected until the vendor delivers a patch. Administrators should verify the installed version on user devices to assess exposure.

The CVSS base score of 5.3 indicates moderate severity. An EPSS score is not available, so a precise exploitation probability cannot be quantified, but the absence of a KEV listing suggests no documented exploitation at present. Based on the description, the likely attack vector involves an authenticated user manipulating client‑side requests or data to override authorization checks. Successful exploitation requires only valid credentials and does not need additional privileges beyond regular application access.