An authorization bypass flaw in HYPR Server allows an attacker to gain higher privileges on the system. The vulnerability stems from a user‑controlled key that is improperly validated, enabling privilege escalation when an attacker supplies a crafted request. The weakness aligns with CWE‑639, which concerns improper authorization checks. The impact is the ability for an attacker to execute actions typically reserved for higher‑privileged users, potentially compromising data integrity and system control.

HYPR Server installations between versions 9.5.2 and before 10.7.2 are affected. Users running any release in this range should verify whether their deployment includes the vulnerable implementation of the user‑controlled key mechanism.

The CVSS score of 5.6 denotes a moderate risk level. The EPSS score of less than 1% suggests that exploitation in the wild is currently infrequent, and the vulnerability is not listed in the CISA KEV catalog. Based on the vulnerability description, the likely attack vector involves remotely sending a request that includes a user‑controlled key, implying that network access to the server’s API or web interface facilitates exploitation. This inference is made from the nature of the control flow described; the CVE entry does not detail the attack surface explicitly.