The vulnerability is triggered when the project_id argument for the Delivery Deployment Endpoint (deli.py) is manipulated, allowing an attacker to bypass standard authorization checks and gain privileges beyond those normally assigned. This bypass corresponds to the CWE‑285 authority not recognized and the CWE‑639 authorization bypass through user‑controlled key weaknesses; as a result the attacker can invoke privileged operations, potentially compromising data confidentiality, integrity, and availability for the targeted project. The impact is the exposure of privileged functions to unauthenticated or partially authenticated users, enabling them to use or modify resources without proper authorization.

The issue affects the guohongze adminset application version 0.61 and earlier. No other products or vendors are listed in the CNA data. Users of this version should verify their installation and upgrade path to a version that removes the vulnerability.

A CVSS score of 5.3 indicates moderate severity; the EPSS score of less than 1% reflects a very low but nonzero likelihood of exploitation at the time of analysis. The vulnerability is listed as not included in CISA KEV and is exploitable remotely. The available public exploit confirms that an attacker can remotely manipulate the project_id value to override authorization checks, making the risk real for environments that expose the endpoint without additional safeguards.