The vulnerability is an IDOR flaw in the Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd. Co. DijiDemi application, allowing an unauthorized user to supply a user‑controlled key that bypasses normal access controls. This flaw is identified as CWE‑639 and can lead to privilege abuse, granting access to data or operations that should be restricted to authenticated or authorized users.

Affected instances are those running DijiDemi versions from v4.5.12.1 up to, but not including, v4.5.13.0 on the Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd. Co. product. Systems using the specified versions are vulnerable to this authorization bypass.

The CVSS score of 6.8 indicates a moderate severity with potential for significant impact. No EPSS value is published, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at the time of analysis. Based on the description, the likely attack vector involves a remote or network‑accessible endpoint that accepts a user‑controlled key; an attacker would need to supply a valid key to the system to exploit the IDOR, which is then exploited by the application’s insufficient authorization checks.