The vulnerability arises from missing authentication mechanisms for a critical function in CafePlus, allowing attackers to access functionality that should be secured by access control lists. Without proper authentication, malicious users can invoke privileged operations, potentially leading to remote code execution. This weakness is classified as CWE-306, missing authentication.

AKIN Software Computer Import Export Industry and Trade Ltd. produces CafePlus. Versions ranging from 12.05.03 up to, but not including, 12.05.04 are impacted. Users running these versions are susceptible unless they restrict exposure or apply a patch.

The CVSS score of 8.8 indicates high severity, and while an EPSS score is not available, the lack of a KEV listing suggests no confirmed exploits yet. Nevertheless, the missing authentication implies that once the web interface or API is reachable, an attacker can execute the vulnerable function without needing valid credentials. Attackers could automate requests to the exposed endpoint to gain arbitrary code execution on the host.