An insecure direct object reference in the Users API allows a remote, authenticated attacker to perform user modification actions through improper permission validation. This flaw can lead to unauthorized changes in user data, enabling privilege escalation or data tampering, compromising both data integrity and confidentiality. The weakness is a classic authorization bypass (CWE-639).

Vendors Arcadia Technology, LLC, product Crafty Controller. All releases prior to version 4.10.3 are affected, as the vulnerability exists in the Users API component before that patch.

The CVSS score of 9 indicates a critical severity. The exploit requires authentication but can be performed remotely via the exposed API, making it feasible for attackers with valid credentials. No EPSS data is available, and the issue is not currently listed in the CISA KEV catalog. Attackers can use the compromised endpoint to modify other users, potentially granting further access or manipulating sensitive information.