B3log Symphony versions up to 3.6.4 contain a missing authorization flaw that allows unauthenticated users to access administrative routes. The vulnerability enables attackers to invoke endpoints such as /admin/report/ignore/{reportId}, /admin/tags/remove-unused, and /admin/user/{userId}/init-point, which can delete unused tags, ignore reports, or grant points without audit logging. The weakness is a failure to enforce proper access control (CWE‑862).

The affected product is B3log Symphony, all releases through version 3.6.4. No specific sub‑versions are listed, so any installation that has not been upgraded beyond 3.6.4 is potentially vulnerable.

The CVSS score of 6.9 indicates moderate severity, and no EPSS score is available, suggesting limited public exploitation data. The vulnerability is not included in the CISA KEV catalog. Attackers can exploit this flaw by issuing unauthenticated HTTP requests directly to the vulnerable URLs; the likely attack vector is web traffic to the application. Because authentication is bypassed, any attacker who can reach the service can gain privileged functionality without further credentials.