A missing object‑level authorization check in the sysPass JSON‑RPC API allows holders of any valid API token to enumerate account metadata, change passwords, and delete accounts without respecting per‑account access control, effectively enabling full control of every account in the vault. The flaw is classified as CWE‑639 and can lead to both data compromise and disruption of service for all users.

The vulnerability affects the sysPass product from nuxsmin. All releases up to and including version 3.2.11 are impacted. Systems running these versions are exposed to an unauthorized authorization bypass that permits enumeration, modification, and deletion of any account by API token holders.

The CVSS score of 8.7 indicates a high severity flaw, while an EPSS score of <1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending specially crafted JSON‑RPC requests to AccountController methods such as viewAction, editAction, deleteAction, and editPassAction; possession of a legitimate API token is the only prerequisite, with no additional privileges or code execution required.