The vulnerability allows an authenticated user who has been registered as a victim’s emergency contact to trick the system into approving an account recovery request without observing the configured waiting period. By sending a crafted approve‑recovery API request, the attacker can bypass the intended authorization controls and become an administrator of the victim’s account, thereby compromising confidentiality, integrity, and availability of that account as a whole. This is an example of an authorization bypass that allows an attacker to gain full control over the victim’s account.

Ente:Museum Server is affected. Version information is not explicitly provided in the CVE data, so the scope of vulnerable releases is unknown.

The overall risk remains moderate to high because an authenticated user with emergency contact status can bypass authorization controls and gain full control of the victim's account. The CVSS score of 6.5 indicates a medium to high severity. The EPSS score indicates a very low probability of exploitation currently, but the vulnerability is not listed in the KEV catalog, so no evidence of active exploitation is reported. Defenders should consider the authorization bypass a serious flaw and treat it as a high‑priority remediation item, especially if users in the affected environment have registered emergency contacts.