This vulnerability is an IDOR that permits an authenticated user to manipulate a user-controlled key to bypass authorization checks, effectively allowing the user to read or modify data and invoke actions that should be restricted to higher-privileged accounts. The flaw is identified as CWE-639.

The affected product is MeWare Software Development Inc. PDKS. Any installations running a version from V16.20200313 up to but not including VMYR_3.5.2025117 are vulnerable. Versions after VMYR_3.5.2025117 have the fix.

The CVSS score of 8.1 marks this as high severity. Although the EPSS score is unavailable, the absence of an KEV listing suggests no known public exploitation as of now. Attackers can exploit the flaw remotely, typically through the application’s web or API interface, by supplying crafted key parameters. Successful exploitation would give the attacker unauthorized access to sensitive data or privileged functions.