The flaw exists in the CRUD endpoint of the code-projects Contact Management System 1.0, where an attacker can manipulate the ID argument to bypass authentication checks, enabling unauthorized access to contact records. The vulnerability is tied to CWE-287 and, according to the description, can be triggered remotely via crafted HTTP requests. The likely attack vector is malicious requests from a remote host. If exploited, an attacker could read, modify, or delete sensitive contact information, thereby compromising confidentiality, integrity, and potentially availability of the system.

The affected product is the code-projects Contact Management System version 1.0. The vendor list and CPE string specify this single version, and no other versions or components are listed as impacted.

The CVSS score of 6.9 classifies the vulnerability as medium severity. The EPSS score is less than 1%, indicating a very low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the flaw can be exploited remotely through crafted HTTP requests that alter the ID argument, allowing an attacker to bypass authentication and gain unauthorized access to CRUD operations. While the exploitation probability is currently low, the potential impact on confidential contact data still warrants remediation.