The vulnerability is an IDOR that permits an attacker with a user-controlled key to bypass authorization checks and gain access to data or functions that should be restricted. This can result in unauthorised disclosure, modification of trusted identifiers, or other privileged operations, directly compromising the confidentiality and integrity of the application. Based on the description, it is inferred that the attacker must craft requests containing a trusted identifier to exploit the bypass.

This issue affects Universal Software Inc.’s FlexCity/Kiosk product versions before 1.0.36. Exposed trust in user-controlled identifiers allows exploitation across any installation running those earlier releases.

The flaw carries a CVSS score of 8.3 and an EPSS score below 1 %, indicating low current exploitation probability. It is not listed in KEV, suggesting no widespread, known active exploitation. An attacker can carry out the attack by crafting requests that include a trusted identifier; the vulnerability exploits improper reference validation, classified as CWE‑639. Based on the description, it is inferred that the likely attack vector involves sending crafted HTTP requests with a user-controlled trusted identifier.