A flaw in newpanjing SimpleUI’s AjaxAdmin AJAX endpoint allows an attacker to invoke the self.get_action function without authentication. Because the code does not verify user credentials before executing privileged actions, malicious callers can perform any administrative operation, potentially exposing sensitive data or altering system state. The weakness is a classic authentication bypass (CWE-287) combined with missing authorization control (CWE-306).

The newpanjing simpleui version 2026.01.13 is affected. Any deployment that includes the AjaxAdmin feature is at risk; earlier or later releases may not contain the flaw.

The CVSS score of 6.9 indicates a medium-to-high severity, while the EPSS score of <1% shows a very low probability of exploitation. Nonetheless, a publicly available exploit exists, and because the endpoint is reachable over the network, attackers can remotely exploit the vulnerability without local access. The CVE is not listed in the CISA KEV catalog, but the presence of a working exploit and the ease of remote access warrant prompt action.