The vulnerability is caused by missing authorization checks on several web application endpoints in the Wertheim SafeController Software. An attacker who has only minimal authenticated privileges can reach endpoints that are invisible in the user interface and perform actions such as switching branches, uploading arbitrary files, downloading arbitrary files, and viewing details of arbitrary branches. This allows the attacker to read, modify, and potentially tamper with data that should be protected, effectively bypassing internal access controls within the system.

The affected product is the Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System) from Wertheim GmbH. The specific affected build identified in the advisory is AssemblyVersion 6.15.8328.28014, and prior releases of the same product may also be vulnerable until a patch is applied.

The CVSS score of 8.6 indicates a high severity, and the vulnerability can be exploited by any authenticated user with low privileges through the web interface. Although the EPSS score is not available, the lack of a KEV listing does not diminish the risk of exploitation. The likely attack vector is through the web application, requiring only legitimate credentials and minimal privileges; once accessed, the attacker can perform unauthorized actions that compromise data confidentiality and integrity.