Stencil core 4.43.5 has an incorrect access control flaw that permits a user to reach resources or endpoints that should be protected. The impact is unauthorized access to protected content or services. The scope of impact depends on how the application integrates Stencil core, but any protected endpoint that relies on the vulnerable access control logic is at risk.

Applications that incorporate Stencil core 4.43.5 are affected. No additional vendor or version information is available beyond the 4.43.5 release.

A CVSS score of 5.3 and an EPSS score of <1% are provided, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector involves unauthenticated or poorly authenticated web requests that reach protected resources. Exploitability is uncertain due to a lack of publicly reported attacks, but the potential to gain unauthorized access remains high for exposed endpoints.