The vulnerability in IKUS Rdiffweb prior to version 2.10.5 is an improper authorization flaw. The API does not bind the authenticated subject to the targeted user or tenant, allowing an attacker who possesses any valid or stolen access token to impersonate other users. This capability enables reading or modifying other users’ data and, in some cases, performing privileged actions that may affect entire tenants.

Systems running IKUS Rdiffweb versions earlier than 2.10.5 are impacted. The issue has been addressed in version 2.10.6 and later releases.

Exploitation requires possession of a valid or compromised token. The likely attack vector is through crafted API requests sent over the network, which bypass all authorization checks. With a CVSS score of 8.1 and an EPSS score of < 1%, the risk is significant, especially when an attacker gains token access. The vulnerability is not listed in CISA’s KEV catalog. The straightforward exploitation path implies a real threat when an attacker owns a token, enabling full access to the data and operations of any affected tenant.