The vulnerability manifests as an authorization bypass on the /api/v1/users/ endpoint of the zhinianboke xianyu-auto-reply backend. An attacker may manipulate a request to that endpoint, allowing read or modification of user data without the proper authentication and role checks. The weakness is captured by CWE-862 (Missing Authorization) and CWE-863 (Missing Role‑Based Access Control). The result is unauthorized access to backend functionality and potentially compromising all user accounts.

Affected versions cover any zhinianboke xianyu-auto-reply deployment built from source before the commit 19fc3282a1bb78a05c34945c088525d20e081cbd. As the project follows a rolling release model, specific version numbers are not given, but any instance running code prior to that patch is vulnerable.

The CVSS score of 6.9 indicates a moderate severity, while an EPSS score of less than 1% suggests low likelihood of current exploitation in the wild. The flaw is not listed in the CISA KEV catalog. However, the public release of the exploit and the ability to attain unauthorized access remotely mean that administrators should treat this as a moderate to high risk until the patch is applied.