OPEXUS eCASE Audit allows an authenticated user to bypass restrictions by altering client‑side JavaScript or sending crafted HTTP requests, enabling access to functions or buttons normally disabled or blocked by an administrator. This flaw does not provide remote code execution; it simply permits the attacker to perform actions that should be prohibited by the system's authorization logic. The threat is limited to accounts with legitimate authentication credentials.

All installations of OPEXUS eCASE Audit older than version 11.14.1.0 are vulnerable. The issue resides in the platform component that handles client‑side interfaces and authorization checks. OPEXUS provides the product eCASE Audit.

The CVSS score of 7.2 indicates a moderate severity. The EPSS score of less than 1% suggests exploitation is unlikely. The vulnerability is not listed in CISA KEV. Attack requires valid credentials, so compromised or weak user accounts present the primary risk. Once authenticated, the attacker can exploit the access‑control bypass without additional network exposure.