The vulnerability lies in the CollectionRouter.invoke function of zilliztech deep-searcher, where manipulation of the keyword arguments allows the bypass of intended access controls. This weakness enables an attacker to execute actions with elevated privileges or access protected resources that should be restricted, potentially leading to unauthorized data manipulation or disclosure. The flaw is classified as CWE-266 and CWE-284 and carries a CVSS score of 5.3, indicating moderate overall risk.

Vendors affected are zilliztech with its deep-searcher product. The issue exists in all releases up to and including version 0.0.2. Users running any of these versions should verify whether they expose the CollectionRouter.invoke endpoint to external requests.

Remote exploitation is feasible; the vulnerability has been demonstrated publicly on GitHub and VulDB, and the exploit code is available to attackers. While a CVSS score of 5.3 suggests moderate severity, the lack of KEV listing and an unavailable EPSS score do not diminish the risk of an attacker planning to target exposed deep-searcher instances. The attack vector is remote, requiring network access to the service that hosts CollectionRouter.invoke.