Uncontrolled eval() of request parameters in the SENAITE.CORE JSON API permits an anonymous user to execute arbitrary Python code, while missing checks for the "senaite.core: Access JSON API" permission on state‑changing routes. This combination of unsafe code evaluation (CWE‑95) and missing privilege checks (CWE‑862) allows an attacker to read, modify or delete laboratory data, files, and accounts, or disrupt service. The flaw applies to all SENAITE.CORE releases from 2.0.0 through 2.6.0.

Vulnerable versions include SENAITE.CORE 2.0.0 through 2.6.0, delivered under the vendor name SENAITE and the product designation SENAITE.CORE. Only releases within that stated range are affected; newer or older versions are not impacted by this flaw.

The CVSS score of 9.8 indicates a critical severity, but the EPSS score is unavailable, so the current probability of exploitation cannot be quantified. Because no authentication is required and the vulnerability is triggered through the public JSON API, the attack vector is remote. An attacker can chain two requests: first discover the object identifier for bika_setup, then send malicious code such as RejectionReasons to the update endpoint, executing arbitrary Python in the target Zope process before any roll-back. The flaw is listed in the defined CWE identifiers but is not yet included in the CISA KEV catalog.