An insecure direct object reference allows an authenticated low‑privileged user to manipulate the employee_id parameter on the password change page and modify the credentials of any other account, including administrators. Because the application does not verify ownership of the requested object, the attacker can change another user’s password and subsequently log in as that user, thereby gaining full control over the system. This breach compromises both confidentiality and integrity of the application and its data.

The vulnerability exists in the Open Source Point of Sale web application made by opensourcepos. Versions released before 3.4.2 are affected; the 3.4.2 release adds object‑level authorization checks that prevent this exploit.

The CVSS score of 6.5 indicates a moderate level of severity, while the EPSS score of less than 1% suggests that active exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. It is inferred that the attack requires an authenticated user who knows or can guess a target employee_id; once the IDOR is used to change a password, the attacker can thereafter log in as the target. The likely attack vector is the web interface password change page and is limited to users with existing credentials.