The vulnerability is rooted in the BLUVOYIX backend APIs, where improper authentication allows an attacker who is not authenticated to send crafted HTTP requests and obtain full access to customer data. The result is a comprehensive compromise of the platform, providing the attacker with the ability to read, modify, or delete sensitive information without authorization.

The affected system is BLUVOYIX from Bluspark Global. No specific version information was supplied, so the impact applies to all iterations of the platform until an official fix is released by the vendor.

The CVSS base score of 10 indicates maximum severity, yet the EPSS score is under 1%, suggesting low current exploitation probability. The vulnerability is not identified in CISA’s KEV list. Attackers would need remote network access to the backend APIs, and the payload is delivered via HTTP requests, implying a network‑based attack vector. Given the high severity and complete loss of data integrity, the overall risk remains critical pending a patch.