An unauthorized user can modify configuration through API calls in OpenText Access Manager. The missing authorization check allows an attacker who can reach the API to change system settings, potentially altering permissions, flow rules, or other critical configuration, thereby compromising the security posture. This flaw is classified as missing authorization for privileged API access (CWE‑648). The likely attack vector is through the publicly exposed API endpoint, as the description indicates API calls but does not specify authentication requirements.

The vulnerability affects OpenText Access Manager releases before version 5.1.3. Any deployment of Access Manager 5.1.2 or earlier is vulnerable when the API is accessible without adequate authorization checks.

The CVSS base score of 6.3 indicates moderate severity, and no EPSS data is currently available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker with network access to the API endpoint can exploit the missing authorization to alter configuration settings. Because the flaw allows privileged changes without authentication, it is considered a significant risk to the integrity and availability of the configuration state.