The vulnerability lies in the storage endpoint /storage/upload of cjbi admin3 v3.0.0. The endpoint performs no permission checks, allowing any authenticated user to upload arbitrary files and any unauthenticated user to download them. This leads to potential exfiltration of data, delivery of malicious files, and unauthorized content access, compromising confidentiality and integrity.

The affected product is cjbi admin3, version 3.0.0. No specific vendor information beyond the product name is provided. The vulnerability affects the storage component exposed at /storage/upload.

The full CVSS score is not available, and the EPSS is unavailable, but given the nature of missing authorization checks and the ability to upload and download arbitrary files, the risk is high. The vulnerability can be exploited remotely via a web browser or automated scripts by any logged‑in user or anonymous attacker, with no special prerequisites beyond access to the affected instance. It is not listed in the CISA KEV catalog, though that may not reflect its actual exploitation potential.