A missing authorization check in the QuantumCloud ChatBot plugin allows an attacker to exploit incorrectly configured access control security levels, enabling the execution of privileged actions without proper authentication. The vulnerability is identified as a Broken Access Control flaw (CWE-862). While the description does not state the specific operations that can be performed, such control failures typically permit unauthorized modification of plugin settings, viewing sensitive data, or initiating automated chat responses. The impact is the loss of confidentiality, integrity, and potentially availability of the chat service, and could be exploited by any user who can send crafted requests to the plugin’s endpoints.

The vulnerability affects the QuantumCloud ChatBot plugin version 7.7.3 and earlier. All installations of QuantumCloud ChatBot running any version up to and including 7.7.3 are susceptible. No other vendor or product versions are listed as impacted.

The CVSS score of 4.3 indicates moderate overall risk, and the EPSS score of less than 1% suggests a very low probability of exploit in the wild at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the web interface or REST API exposed by the plugin; an attacker who can reach these interfaces may send specially crafted requests to circumvent access controls. The lack of an official solution or workaround makes timely patching essential to mitigate the risk.