GazellePosterWall contains a broken access control flaw in its IP lock manager. The flaw permits an authenticated user to add, modify, or delete IP lock entries for any account through tools.php?action=iplock. By manipulating these entries, an attacker can override bans, deny legitimate users, or create denial of service conditions. The weakness maps to CWE‑284, indicating improper authorization checks.

The vulnerability exists only in the GazellePosterWall codebase, specifically at commit 86c4bedf727691b5a97af42a4864869d18446449. No other vendor or product versions are listed. Accordingly, the affected scope appears limited to this snapshot, and users who have deployed this specific commit should verify whether a newer version contains the fix.

An attacker must first have an authenticated session, but beyond that no privileged escalation is required. The likely attack vector is inferred to be a remote request to tools.php?action=iplock that alters IP lock entries. The CVSS score of 5.4 signals moderate risk, and the EPSS score of <1% indicates a low likelihood of exploitation. The vulnerability is not currently listed in CISA's KEV catalog. However, documented exploit references show that once credentials are obtained, the impact can be significant.