A flaw was discovered in the Visual Integrated Command and Dispatch Platform that allows attackers to manipulate the ID parameter in the "/dm/dispatch/user/delete" endpoint. This manipulation overrides the platform’s access control, enabling an attacker to delete user accounts remotely. The vulnerability results in an authorization bypass that compromises the integrity of the user management subsystem and potentially facilitates further privilege escalation.

The vulnerability affects Rongzhitong’s Visual Integrated Command and Dispatch Platform releases up to February 6 2026. It resides in the User Handler component responsible for processing deletion requests, but the vendor has not published specific patch versions or affected sub‑versions.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1 % suggests a low probability of exploitation in the wild. The vulnerability is publicly disclosed and can be exploited over the network, yet it has not been listed in the CISA KEV catalog, meaning it has not been recorded as part of a known exploitation campaign. However, the absence of a vendor fix and the remote nature of the attack elevate the risk for organizations running the vulnerable release.