An improper authorization flaw exists in the InstallController component of perfree’s go-fastdfs-web, affecting versions up to 1.3.7. The bug allows an attacker to bypass access controls, potentially executing privileged operations or accessing sensitive data without proper authentication. This weakness aligns with common vulnerability identifiers CWE‑266 and CWE‑285, which represent inadequate permission enforcement and unauthorized privilege escalation.

The vulnerable product is perfree:go-fastdfs-web, specifically every release up to version 1.3.7. The flaw is located in src/main/java/com/perfree/controller/InstallController.java within the doInstall interface, and no later versions have been documented as affected.

The CVSS score of 6.9 indicates moderate severity, and the vulnerability is not listed in the KEV catalog. No EPSS data are available, but the description states the exploit has been publicly disclosed and may be used. It is inferred that the attack vector is remote, allowing external actors to trigger the vulnerability by accessing the InstallController endpoint. Given these factors, the risk remains moderate to high until a vendor patch or equivalent mitigation is applied.