The reported flaw arises from insufficient authentication and authorization checks in the platform’s login service, classifying it as a CWE‑1390 vulnerability. An attacker can craft authentication requests that bypass the required session validation, enabling unauthenticated remote access. Once authenticated, the attacker may impersonate any platform user—including administrators—and read or modify sensitive data, thereby jeopardizing confidentiality, integrity, and overall system availability.

The CreditNirvana Collections Platform (CollectionWorkz) versions released prior to 4.8.2 are affected, as identified by the vendor/product information and the CNA’s CPE entry.

The CVSS score of 9.3 marks this flaw as critical, and the lack of an EPSS value does not diminish the remote nature of the attack described. Although the vulnerability is not listed in the CISA KEV catalog, attackers can exploit it via the exposed login and API endpoints, enabling privilege escalation and data compromise if a vulnerable version remains in use.