The vulnerability allows an attacker to access the DocumentOpen.aspx endpoint and iterate through predictable chargeNumber values to download any file that has been uploaded to the application. This flaw prevents proper authorization checks and leads to disclosure of potentially confidential documents. The weakness represents an Insecure Direct Object Reference that enables unauthorized data access (CWE-639).

The issue affects the OPEXUS eComplaint application prior to version 9.0.45.0. Any deployment of OPEXUS eComplaint before this release, regardless of vendor environment, is vulnerable. Users on older versions should verify the installed release number and plan for remediation.

The CVSS score of 8.7 demonstrates a high severity level, and the EPSS score of less than 1% indicates a low probability of exploitation at this time. The vulnerability is exploited remotely through HTTP requests to an endpoint that accepts a numeric chargeNumber parameter. Even though the attack requires iterative probing of predictable values, the process is straightforward once the endpoint is discovered. Although the vulnerability is not currently listed in the CISA KEV catalog, the potential for sensitive data leakage warrants proactive patching.