Openwave Webtop Media Transcoder does not enforce administrator‑defined file type restrictions, allowing an authenticated user to process and convert unintended document types when bypassing the Webmail experience. This failure, a restriction of operations within bounds (CWE‑669), can result in the conversion of sensitive or malicious files, potentially exposing internal data or consuming server resources in an uncontrolled manner.

The affected product is Openwave Messaging (Ireland) Limited: Webtop Media Transcoder. No specific version information is provided in the advisory.

The CVSS score of 4.3 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Attack is limited to authenticated users who can bypass the Webmail interface, so the risk primarily affects internal users. A malicious or compromised user could convert arbitrary files, potentially exposing sensitive data or overloading the conversion service. Because the exploit requires legitimate authentication, the likelihood of exploitation depends on the strength of user credentials and access controls, but it remains a concern for organizations that use this component.