The vulnerability stems from a missing backend authorization mechanism in the CashDro 3 administration panel, version 24.01.00.26. As a result, the application relies solely on client‑side checks. By tampering with the binary string in the Permissions field of the JSON response, an attacker can bypass all existing protections and obtain unrestricted administrative privileges. This flaw constitutes a flaw in access control (CWE‑862) and enables complete takeover of the management interface.

The CashDro 3 Administration Panel, specifically version 24.01.00.26 of the software, is affected. The fix has been incorporated into the supported release 26.01.00.16, which is the only version currently available on the distribution repository; older releases have been removed for security reasons.

The CVSS score of 8.6 categorizes this exploit as a high‑severity issue. The EPSS score is unavailable, but the lack of existing mitigations suggests a non‑negligible exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers would most likely exploit the flaw remotely via the web administration interface, assuming the panel is reachable over the network.