The vulnerability resides in EmployeeController.java of the production_ssm and ssm-erp projects, allowing an attacker to manipulate requests and bypass authorization checks. This flaw is caused by missing or incorrect enforcement of access controls, representing CWE-266 and CWE-285 weaknesses. The attacker can gain unauthorized access to sensitive resources or perform privileged operations, thereby compromising confidentiality, integrity, and potentially availability of the application.

Affected products include production_ssm and ssm-erp from both feng_ha_ha and megagao. No fixed version information is provided; the projects use a rolling release model and the specific affected commit is identified only by an older Git hash. Users running any pre‑update release before the fix commit are potentially vulnerable.

With a CVSS score of 5.3 and an EPSS score below 1%, this issue is of medium severity and is currently not listed in the CISA KEV catalog, indicating no known widespread exploitation. The attack requires remote interaction but no authentication is mentioned, implying that the flaw can be abused by anonymous users. The risk remains moderate but requires monitoring, as the flaw permits unauthorized actions without a patch.