HaPe PKH 1.1 does not enforce authorization on its delete endpoints, allowing an unauthenticated attacker to submit a request that specifies any record ID and cause that record to be removed. The missing check applies to the deletion routes for administrator accounts and update records, which can result in the loss of critical data or the removal of privileged user accounts, thus compromising confidentiality and integrity of the application data.

The affected product is HaPe PKH version 1.1 from Sitejo. The vulnerability is present in the module handling pengurus (administrator) deletions and the update records deletion endpoint; no other versions or implementations are listed.

The CVSS score of 8.7 indicates a high severity vulnerability. No EPSS score is available, but the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it by sending a crafted HTTP request to the exposed delete URLs without any authentication, so the attack vector is web-based and requires that the endpoints are reachable from the attacker’s network.