The flaw occurs in the proses/add.php file of RafyMrX TOKO-ONLINE-ROTI. By manipulating the kd_cs parameter, an attacker can cause the application to skip its normal authorization checks, granting access to privileged functionality that should be restricted. This bypass combines an unauthorized privilege escalation with insecure trust assumptions, as indicated by CWE‑285 and CWE‑639. The primary impact is the loss of confidentiality and integrity of protected resources, because non‑privileged users could invoke restricted add functionality without proper credentials.

RafyMrX TOKO-ONLINE-ROTI is the impacted product. The vulnerability is tied to code commits up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. No specific version numbers are available because the project follows a rolling release model, so any current release incorporating that commit is potentially affected.

The CVSS score of 5.3 classifies the issue as moderate severity. The EPSS score is below 1%, which indicates a low probability of widespread exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation can be carried out remotely by sending crafted HTTP requests to add.php with altered kd_cs values. Successful exploitation would allow unauthenticated or low‑privilege users to carry out actions reserved for higher‑privileged accounts, thereby compromising system security.