The vulnerability is located in the setConfig function of the Ajax.php controller in funadmin up to version 7.1.0-rc4. Authorization checks are bypassed, allowing an attacker to modify configuration settings without proper privileges. This can compromise the integrity of system configuration and potentially create pathways for further attacks.

The affected vendor is funadmin. Users running any release up to funadmin 7.1.0-rc4, including the release candidates rc1 through rc4, are vulnerable. Versions beyond rc4 are not affected.

The CVSS base score is 6.9, indicating a moderate severity. The Exploit Prediction Scoring System rate is less than 1%, implying that, at present, the likelihood of exploitation is low. However, the vulnerability is exploitable remotely, the exploit code has been publicly released, and the vulnerability has not been added to CISA’s Known Exploited Vulnerabilities catalog. Attackers with network access to the target can manipulate the setConfig endpoint to authorize configuration changes without proper authentication.