Sparx Enterprise Architect implements role‑based access controls to limit user actions, yet the vulnerability identified as CWE‑603 allows an authenticated attacker to modify the client application with debugging techniques so they can impersonate any user or administrator. This impersonation grants unrestricted modification rights to the repository, enabling the attacker to alter, delete, or add data and thereby compromise the confidentiality, integrity, and availability of stored information.

The affected product is Sparx Systems’ Enterprise Architect. Versions 17.1 and earlier have been explicitly tested and confirmed vulnerable. Information about newer releases is unavailable, so they may or may not contain a fix.

The CVSS score of 8.7 indicates a high‑severity risk. No EPSS score is published, but the absence from CISA KEV suggests no widespread exploitation has been reported. Exploitation requires an authenticated user who can locally modify the client, reauthenticate as a higher‑privileged account, and then perform any repository operation. The ability to gain full control of the repository constitutes a significant threat to organizations using this tool.