The vulnerability is an IDOR that allows an attacker to manipulate a user-controlled key to bypass authorization checks and access functionality not properly constrained by ACLs. This can enable unauthorized operations or data disclosure. The weakness is identified as CWE‑639.

All installations of Netiket Information Technologies EdoWEB with versions prior to 780‑g7 are affected. The vendor product EdoWEB is vulnerable on those firmware versions.

The CVSS score of 4.3 indicates moderate severity, and there is no EPSS score available, making exploitation probability unclear. The vulnerability is not listed in CISA’s KEV catalog, which suggests it may not currently be actively exploited. The likely attack vector involves an IDOR via manipulated request parameters; this inference is drawn from the description of a User‑Controlled key bypass.