Technical impact
Based on the description, it is inferred that a flaw in the Security API of go2ismail Free‑CRM allows an attacker to bypass authorization controls. This weakness permits remote exploitation of privileged endpoints, potentially exposing sensitive data or functionality. It exemplifies CWE‑266 (Missing Authorization) and CWE‑285 (Improper Authorization), and may compromise confidentiality, integrity, or availability for unauthorised users.
Affected Systems
Based on the description, it is inferred that the vulnerability impacts go2ismail Free‑CRM, specifically an unidentified component of the /api/Security path. Because version information is unavailable due to the product’s rolling‑release strategy, any instance running an unpatched build is potentially exposed.
Risk and Exploitability
The CVSS base score of 5.3 indicates moderate severity. The EPSS score is below 1%, suggesting that exploitation is unlikely but still possible given the publicly available exploit code. Because the vulnerability is not listed in the KEV catalog, known exploitation appears limited. Based on the description, it is inferred that remote attackers could leverage unauthenticated or insufficiently privileged access to manipulate Security API endpoints, potentially escalating privileges or extracting sensitive information. Defensive measures should be applied promptly to mitigate potential exploitation.
