A flaw exists in the app/del.php file of icret EasyImage, where manipulation of the hash argument can bypass normal privilege checks, allowing an attacker to delete or alter content with elevated rights. The vulnerability is tied to two well‑known weaknesses: unauthorized escalation of privileges (CWE-266) and improper access control (CWE-269). This function can be accessed remotely, meaning the attack does not require local interaction or authentication beyond providing a crafted argument. Once exploited, the attacker could remove or modify image data that should be protected by the application’s normal authorization regime, potentially affecting confidentiality and integrity of the site’s resources.

The product affected is icret EasyImage version 2.8.7 and earlier. Users running the vulnerable edition should verify their version and apply the latest patch where the flaw is fixed. No other versions of EasyImage or associated components are listed as impacted.

The CVSS score of 6.9 indicates moderate severity. EPSS information is not available, so the exact likelihood of exploitation in the wild is uncertain, but the vulnerability is listed as having a published exploit, which increases the perceived risk. The issue is not currently present in CISA’s KEV catalog, but its remote nature and potential to grant unauthorized deletion or modification rights make it a noteworthy concern. Exploitation would involve sending a manipulated hash value to the vulnerable delete endpoint to trigger the privilege bypass.