An Improper Access Control flaw in Adobe C2PA Tool, Content Credentials JavaScript SDK, and Content Credentials Rust SDK can be exploited to bypass the security feature, granting attackers unauthorized write access. This could allow modification, deletion, or insertion of data normally protected, leading to integrity and confidentiality violations. The vulnerability is defined as CWE-284, meaning access control weaknesses are possible.

The flaw impacts Adobe's C2PA Tool, Content Credentials JavaScript SDK, and Content Credentials Rust SDK. No specific version range is supplied, so any release that has not yet received an update may be vulnerable. Administrators should verify whether their deployed tool or SDK version contains the fix.

With a CVSS score of 7.5 the vulnerability is considered high, though its EPSS score is less than 1 % indicating a low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Based on the description it is inferred that an attacker does not need user interaction; exploitation likely requires remote code execution within an application that incorporates the SDK or local access to the tool. The lack of explicit attack vector details means the attacker would need to exploit an environment where the SDK is loaded, underscoring the importance of patching or restricting write privileges.