The vulnerability arises from improper authorization in a component of SalesERP's Administrative Endpoint. Manipulating the ci_session argument allows an attacker to bypass authentication controls, potentially granting administrative privileges. This flaw could lead to unauthorized configuration changes, data exposure, or system compromise. The reported CVSS score of 5.3 indicates moderate severity, and the exploitation pathway is feasible from a remote location.

All instances of Bdtask SalesERP up to and including version 2026-01-16 are affected. Systems running these releases are at risk because the flaw resides in the Administration Endpoint of the application.

With an EPSS score below 1 % and no inclusion in CISA's KEV catalog, the likelihood of widespread exploitation is low. However, the remote attack vector—modifying the ci_session parameter to gain administrative access—poses a serious risk for exposed deployments. The absence of a vendor response or fix increases the exposure window, making remediation or protective measures urgent.