The vulnerability resides in funadmin’s Member.php repass function, where manipulation of the forget_code or vercode arguments allows an attacker to trigger weak password recovery. This flaw can bypass proper verification, potentially giving an attacker the ability to reset or retrieve a user’s password. Categorized as CWE‑640 due to inadequate authorization checks, a successful exploit would enable unauthorized access to accounts, leading to confidentiality loss and possible privilege escalation.

All installations of funadmin up to and including version 7.1.0‑rc4 are affected, as the flaw exists within the repass routine of app/frontend/controller/Member.php. The vulnerability applies regardless of the operating environment because no platform constraints are specified, meaning every deployed instance of funadmin lacking an update could be vulnerable.

The CVSS score of 6.3 signals moderate severity, but the need for high attack complexity and the difficulty of exploitation lower the immediate threat. The EPSS score of less than 1% indicates that, as of now, the probability of widespread attacks is low. However, the exploit has been made publicly available and is not listed in the KEV catalog, meaning that determined attackers could still target exposed systems remotely by crafting malicious requests to the password recovery endpoint.