The vulnerability is a broken access control (CWE-639) that permits an authenticated user to perform horizontal privilege escalation within the Pointsharp ID Server. An attacker who can log in with valid credentials can exploit the flaw to access resources or data that belong to other users, thereby compromising the confidentiality and integrity of data owned by those users and enabling further lateral movement. The weakness arises because the system fails to enforce proper ownership checks on certain configurations.

The flaw affects the Pointsharp ID Server product. Specific affected versions are not listed, and the issue is limited to particular configurations of the server. Administrators should review the product configuration to determine whether the vulnerable settings are present.

The CVSS score of 8.8 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests a low likelihood of immediate exploitation. This vulnerability is not listed in the CISA KEV catalog, which further indicates that active exploitation has not been reported. Exploitation requires valid authentication and access to the affected configuration, implying that the attack vector is likely remote but restricted to authenticated users. Administrators should treat this as a high priority to patch.