A logic flaw in PEAR’s roadmap authorization check, triggered by operator precedence, allows authenticated users who are not lead maintainers to gain full control over roadmap creation, updates, and deletion. The vulnerability is a classic example of CWE‑783: insecure permissions or access control. An attacker with access to the application can therefore alter project plans, introduce erroneous information, or delete critical roadmap data, potentially leading to loss of integrity and availability for project stakeholders.

The issue affects the PEAR framework and distribution system for reusable PHP components, specifically the pearweb product from vendor pear. Versions prior to 1.33.0 are vulnerable; all releases 1.33.0 and newer have the fix applied.

The CVSS base score of 7.1 indicates a high severity vulnerability, but EPSS shows a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. However, the attack vector appears to be local to the web application; an authenticated non-lead user can execute the exploit simply by creating or manipulating a roadmap, as no additional conditions are required beyond legitimate credentials.