The vulnerability is a missing authorization check in the /web/admin/welcome.php script of the Simple Content Management System. When an attacker crafts a request that sets the 'addnews' argument, the system accepts it without verifying that the user has administrative privileges. This flaw allows an unauthenticated or low‑privileged user to invoke administrative functionality, effectively bypassing the intended access controls.

The vulnerability affects code‑projects Simple Content Management System version 1.0. No other versions are listed. The affected source is the admin interface component.

The CVSS score of 6.9 indicates a moderate‑to‑high risk, while the EPSS score is not available. The flaw is not listed in the CISA KEV catalog. Because the attack can be launched remotely via HTTP requests, an attacker with network access can exploit the missing authorization to gain administrative rights. Public exploitation code is available, raising the likelihood of real‑world attacks.