The vulnerability resides in the /api/system/dashboard/getCount endpoint of CoCoTeaNet CyreneAdmin up to version 1.3.0. An attacker can craft a request that bypasses the software's authorization checks, allowing the attacker to read system information or gain privileges beyond those intended. This flaw is a manifestation of improper privilege management and authorization controls (CWE‑266 and CWE‑285).

Affected installations are those running CoCoTeaNet CyreneAdmin versions up to and including 1.3.0. The issue is confined to the System Info Endpoint component. Any deployment that has not upgraded past 1.3.0 is susceptible to the described flaw.

The CVSS score of 5.3 indicates moderate risk. EPSS <1% suggests that automated exploitation is unlikely at present, yet the vulnerability is publicly disclosed, meaning capable attackers could still target it manually. The flaw is not part of the CISA KEV catalog. Attackers can target the system remotely by sending crafted HTTP requests, potentially compromising confidentiality and integrity for users without sufficient privilege.