The vulnerability allows an attacker to manipulate the /dispatch/api?cmd=userinfo endpoint in Rongzhitong Visual Integrated Command and Dispatch Platform. This manipulation bypasses the intended access controls and permits retrieval of user information that should be restricted. The flaw is an improper authorization failure, aligning with CWE‑266 and CWE‑284. As a result, a remote attacker could obtain sensitive user data and potentially use it for further exploitation.

Affected vendor: Rongzhitong. Product: Visual Integrated Command and Dispatch Platform. Versions up to and including 20260206 are impacted. No other versions are listed as affected.

The CVSS score of 6.9 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests that exploitation is unlikely at present. The issue is not on the CISA KEV list, meaning no widespread exploitation has been reported. The attack can be launched remotely via the exposed API, but no additional prerequisites are mentioned beyond the ability to send crafted requests. Maintaining the public disclosure nature of the exploit increases the risk of future attacks.