The vulnerability is an Incorrect Authorization flaw that permits an authenticated remote attacker to modify front‑end code. By doing so the attacker can read all official documents, effectively compromising document confidentiality. The weakness is identified as CWE‑863, an incorrect authentication/authorization issue, and does not directly lead to denial of service or arbitrary code execution.

The affected product is 2100 Technology’s Official Document Management System. The CVE data does not list specific vulnerable versions, but the vendor’s remedy indicates that patching to version 5.0.98.23 or later resolves the issue, implying that earlier versions may lack the fix.

The CVSS score of 7.1 denotes a high severity vulnerability. Although the EPSS score is less than 1 %, indicating very low exploitation probability, the flaw requires legitimate user credentials as a prerequisite. Therefore, the likely attack vector involves an attacker who has obtained valid credentials or compromised an account, after which they exploit the missing authorization controls to read protected documents.