The vulnerability in IKUS Rdiffweb prior to version 2.10.5 is an improper authorization flaw. The API does not bind the authenticated subject to the targeted user or tenant, allowing an attacker who possesses any valid or stolen access token to impersonate other users. This capability enables reading or modifying other users’ data and, in some cases, performing privileged actions that may affect entire tenants.

Systems running IKUS Rdiffweb versions earlier than 2.10.5 are impacted. The issue has been addressed in version 2.10.6 and later releases.

Exploitation requires possession of a valid or compromised token. Attackers can craft API requests over the network to other users or tenants, bypassing all authorization checks. Although no CVSS score or EPSS value is available and the vulnerability is not listed in CISA’s KEV catalog, the impact is high: an attacker can acquire full access to the data and operations of any tenant for which they hold a token. The straightforward exploitation path implies a real threat when an attacker gains token access.