An access control flaw exists in the user addition endpoint (/dm/dispatch/user/add) of the Rongzhitong Visual Integrated Command and Dispatch Platform. The flaw allows an attacker who can reach the component remotely to create user accounts or elevate privileges without proper authorization checks, effectively bypassing the intended access controls. The vulnerability is classified as improper access control (CWE‑284) and authorization bypass through privilege escalation (CWE‑266).

The vulnerability affects the Rongzhitong Visual Integrated Command and Dispatch Platform, with all releases up to and including version 20260206 being potentially susceptible. No specific patch version is listed in the CNA data.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score of less than 1% suggests a very low yet non‑zero exploitation probability at the time of assessment. The vulnerability is currently not listed in CISA’s Known Exploited Vulnerabilities catalog. Based on the description, the attack vector is remote, meaning an adversary can trigger the flaw from outside the protected network without local access. Given its moderate severity and low exploitation likelihood, the overall risk is moderate but warrants timely mitigation to prevent potential abuse of the access controls.