The vulnerability resides in the Clean Endpoint view of the DjangoBlog application, where authentication checks are omitted, allowing an attacker to access the endpoint without credentials. This flaw matches CWE‑287 (Authentication Bypass) and CWE‑306 (Missing Authentication). If exploited, attackers could use the endpoint to trigger actions, potentially leading to unauthorized data exposure or system manipulation, depending on the function performed by the endpoint.

The issue affects liangliangyy DjangoBlog versions up to and including 2.1.0.0. No other affected product or version information is provided.

The CVSS score is 6.9, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The description states the attack can be initiated remotely, and the exploit is publicly available, implying that unauthenticated attackers could exploit the endpoint from outside the network. The vulnerability does not require specialized prerequisites beyond the ability to send a HTTP request to the target.