The vulnerability is an IDOR (CWE-639) that enables an attacker to manipulate a user‑controlled key to bypass authorization checks in the Akilli Commerce E‑Commerce website. This bypass can force the application to treat an impersonated session as legitimate, permitting the attacker to access or modify data belonging to other users and potentially execute privileged actions if the impersonated user holds elevated rights.

Akilli Commerce Software Technologies Ltd. Co.’s E‑Commerce Website is affected for all releases prior to version 4.5.001. The vulnerability applies to the web application layer, affecting every instance of the platform running those versions and leaving all client sessions exposed to hijacking.

The CVSS score of 9.8 marks this flaw as critical, and the absence of an EPSS value indicates that the precise likelihood of exploitation is unknown but potentially high given the nature of IDOR flaws. The vulnerability is not yet in the CISA KEV catalog, but its severity warrants urgent attention. The likely attack vector is the manipulation of a user‑controlled identifier through HTTP parameters or session data, requiring the attacker to reach the vulnerable endpoint; a successful request can hijack any user’s session, offering full read or write access to that user’s data.