A broken access control flaw in the GazellePW API allows any authenticated normal user to toggle any other user’s account status by issuing enable or disable requests with a standard API token. This flaw, identified in commit 86c4bd…, is a classic case of improper authorization (CWE‑284). If exploited, an attacker could de‑activate compromised accounts, lock out legitimate users, or enable accounts to facilitate further attacks, resulting in loss of availability and potential privilege escalation.

The vulnerability is present in GazellePosterWall (GazellePW) applications running the code base that includes commit 86c4bd… and any systems that have not yet applied a fix. It does not rely on any particular external versioning scheme, but any instance exposing the API endpoint for user management is vulnerable. Only authenticated users with a normal API token can perform the action; no administrative privileges are required.

The vulnerability has a CVSS score of 4.3, indicating moderate severity, while the EPSS score of < 1% suggests a low exploitation probability. It is not listed in CISA’s KEV catalog. Nevertheless, the condition is trivially exploitable over the network: an attacker only needs a valid API token and no special privileges. The absence of a patchable edition in the wild means the risk remains high if the application remains unchanged, especially in environments where user state changes impact service availability or legal compliance.