Uncontrolled updates of component properties in django-unicorn versions prior to 0.67.0 allow an attacker to bypass the intended _is_public protection, enabling modification of internal attributes such as template_name and triggering protected methods; this constitutes an Access Control flaw that could lead to unintended behavior or exposure of internal data.

django-commons:django-unicorn; all releases before version 0.67.0 are affected.

The vulnerability has a CVSS score of 5.3, indicating moderate severity. EPSS is below 1%, suggesting a low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Exploitation is likely achievable via remote web requests that manipulate component state, as the checks missing during property updates and method calls make the attack vector feasible in deployed applications.