RansomLook contains an authorization weakness in its web‑based configuration editor. The /admin/config endpoint requires an authenticated session but does not enforce privilege checks, which allows an authenticated low‑privileged user to submit crafted configuration values that are written directly to the application’s config/generic.json file. The attacker can modify notification, LDAP, SMTP, and general application settings, redirect integrations, alter authentication parameters, disrupt services, or render the installation unavailable. The editor also operates on files containing sensitive values such as passwords and API keys, so unauthorized changes can compromise the entire system.

The vulnerability affects the RansomLook application. No specific application versions are listed in the CVE data; administrators should verify if the installed version contains the /admin/config route and consult vendor release notes for remediation.

The CVSS score of 9.4 indicates critical severity, and the vulnerability is listed as CWE‑862. The EPSS score is not available, and the flaw is not in the CISA KEV catalog. The likely attack vector is a web request to /admin/config that requires an authenticated session; once authenticated, a low‑privileged user can manipulate configuration. Because the vulnerability enables modification of security‑sensitive settings, the risk to confidentiality, integrity, and availability is high even if no advanced exploitation techniques are required.