The vulnerability is a missing authorization flaw in Dolusoft Software Technologies’ Sonlogger application, classified as CWE‑862. It allows functions that should be governed by an access control list to be invoked without proper permission checks. Based on the description, it is inferred that an attacker who can send requests to the application could trigger these exposed functions, potentially gaining access to sensitive data, altering configuration settings, or executing actions reserved for privileged users, thereby compromising confidentiality, integrity, or availability.

Affected versions of Sonlogger include all releases from v6.6.6 up to, but not including, v6.7.4.8. The issue exists on the standard installation of Dolusoft Software Technologies Sonlogger, and any deployment using a version in this range remains vulnerable until the vendor releases a fixed build.

The CVSS score of 7.5 indicates a high severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed. The likely attack vector is remote request to the application’s exposed endpoints; however, the lack of a documented exploitation technique means the exact likelihood of a real-world attack remains uncertain. Environments in which Sonlogger is exposed to external users or where default ACL configurations are not hardened may face a higher risk level.