The vulnerability resides in the TodoList.ts model of the CodeGenieApp serverless‑express API endpoint. Manipulating the userId parameter causes the system to ignore proper authorization checks, allowing an attacker to impersonate any user. This flaw can lead to the disclosure or modification of sensitive data and potentially to unauthorized execution of privileged actions within the application. The weakness corresponds to CWE‑285 (Authorization) and CWE‑639 (Authorization Bypass Through User‑Controlled Search).

This flaw affects CodeGenieApp’s serverless‑express component in all releases up to and including version 4.17.1. The affected functionality is located in examples/lambda‑function‑url/packages/api/models/TodoList.ts. No other versions or products have been identified as affected in the CNA data.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is reported as less than 1%, suggesting low but non-zero exploit probability. It is not currently listed in the CISA KEV catalog. The description states that the attack can be carried out remotely, though the precise vector (e.g., HTTP request to the API endpoint) is inferred and not explicitly detailed. Exploitation requires an authenticated or unauthenticated request to the affected endpoint with a manipulated userId parameter, which the software fails to validate, resulting in an authorization bypass.