The vulnerability in Wowza Streaming Engine 4.5.0 allows an authenticated user with read‑only permissions to elevate their privileges to administrator by manipulating POST parameters sent to the user edit endpoint. By setting the `accessLevel` field to `admin` and enabling `advUser` parameters, an attacker can execute the request and gain full administrative control over the streaming platform. This escalation can lead to unauthorized configuration changes, stream creation, deletion, or other administrative actions. The weakness is identified as CWE‑352 (Cross‑Site Request Forgery).

Affected products are Wowza Media Systems, LLC’s Wowza Streaming Engine, specifically version 4.5.0. The vulnerability is present only in that version; no other affected versions are listed.

The CVSS score of 8.7 indicates a high severity. The EPSS score of less than 1% suggests low public exploit probability, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires an authenticated read‑only user account, which can be obtained through compromised credentials or social engineering. Once logged in, the attacker crafts a POST request to the `/userEdit` endpoint with the specified parameters. No additional local privileges are needed beyond the initial authentication, making the exploit straightforward for an attacker with network access to the management interface.