The vulnerability enables improper authorization in the Security API of the Asp.Net-Core-Inventory-Order-Management-System. By manipulating requests to the /api/Security/ endpoint, an attacker can bypass access controls and gain unauthorized access to protected resources, potentially leading to full system compromise. This flaw manifests as a lack of proper authentication checks, fitting CWE-266 (Improper Privilege Management) and CWE-285 (Improper Authorization).

Affected product: go2ismail Asp.Net-Core-Inventory-Order-Management-System, versions up to and including 9.20250118. The vulnerability pertains to components within the Security API exposed via the /api/Security/ path. No other vendor or product variants are listed as impacted.

The severity assigned by CVSS is 5.3, indicating a moderate impact, while the EPSS score is below 1%, reflecting a low but non‑zero likelihood of exploitation in the environment. The vulnerability is not yet present in CISA's KEV catalog. The likely attack vector is remote, as the flaw can be triggered by external request manipulation to the Security API. An attacker would need to construct a crafted request lacking proper authorization, which the system currently fails to validate and which can be performed over the network.