Improper authorization checks of team members privileges allow a team member to elevate privileges to the team owner account. This vulnerability is a classic privilege escalation scenario, where an authenticated user can acquire read and administrative rights normally reserved for the team owner. The weakness is identified as CWE‑863, an improper authorization flaw that can compromise confidentiality, integrity, and availability of team resources.

The affected systems are WebPros' WP Squared and cPanel applications, including deployments on CloudLinux 6 and CentOS 6. No specific version details are listed, indicating that multiple releases may share the same flaw. Vulnerability may impact versioned products that are still maintained with WebPros as the vendor.

The CVSS score of 7.1 denotes a high severity rating, while the EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. An attacker likely needs authenticated access as a team member to exploit this weakness, and the attack vector is inferred to be internal or through a privileged API. The lack of an exploit probability metric suggests limited publicly known exploitation but does not eliminate the potential for targeted attacks that leverage existing access.