The flaw is an access control weakness that allows an authenticated user with Editor rights to acquire Administrator privileges, enabling unauthorized modifications to accounts, passwords, and configuration settings. This is a classic example of improper authorization checks, classified under CWE‑284, and results in a complete compromise of system integrity and confidentiality for all affected users.

The affected product is Impworks Bonsai version 6.0. No other vendors or products are listed, so the impact is restricted to installations running this specific version.

The CVSS score of 8.1 indicates high severity, and although the EPSS suggests a very low likelihood of exploitation (<1%) and it does not appear in CISA’s KEV catalog, the vulnerability remains consequential. Attackers must already possess an authenticated Editor account, a privilege commonly granted to internal users; once in place, the attack path to full Administrator control is straightforward. This combination of high impact and simple exploitation path makes the risk significant for any exposed instance of the software.