An attacker who knows a user's account identifier can exploit a flaw in Gambio 4.9.2.0’s password reset feature to set an arbitrary password for that account. The vulnerability allows a direct bypass of the reset mechanism, effectively granting the attacker full control over the targeted account. This can lead to unauthorized access to sensitive data and potential escalation to other parts of the system if the account has elevated privileges.

The security issue affects Gambio 4.9.2.0, which was patched in the 2024‑02 v1.0.0 release for GX4 versions ranging from v4.0.0.0 to v4.9.2.0. System administrators should verify whether their installations run any of these affected versions and plan to migrate to the patched release.

The vulnerability is remotely exploitable through the web interface where the password reset function is exposed, assuming the attacker can determine a valid account ID. The EPSS score is <1% and the entry is not listed in the CISA KEV catalog, but the CVSS score of 9.1 indicates a critical severity. The ability to take over any account grants significant confidentiality, integrity and availability risk.