An improper access‑control flaw in Progress WS_FTP Server before version 2025.0.5 lets an authenticated user who has folder‑management permissions bypass normal access restrictions and reach or alter files belonging to other users. The weakness, identified as CWE‑863, permits a legitimate account to exceed its intended authorization boundaries, thereby compromising both the confidentiality and integrity of user data within the FTP service.

The vulnerability affects Progress Software’s WS_FTP Server across all prior releases before 2025.0.5. Any installation of these legacy versions that grants folder‑management privileges to a user is susceptible. The affected product is not confined to a single build; all older versions of WS_FTP Server without the service pack are at risk.

The CVSS score of 6.3 indicates a moderate severity risk. While the EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploits are reported. The attack vector is inferred to be internal or remote, depending on whether the user already has authenticated access; once authenticated, the user can manipulate folder permissions to gain access to protected files. Moderately high exploitation potential exists for users with sufficient privileges within the FTP environment.