The vulnerability in Progress Flowmon permits an authenticated low‑privileged user to manipulate the PDF generation request so that the system performs operations with the privileges of another account. This unauthorized privilege escalation can lead to sensitive data exposure and unintended modifications to system configuration, thereby compromising confidentiality, integrity, and potentially availability. The flaw arises from a breach of authorization controls, identified as CWE‑863.

This vulnerability affects Progress Software’s Flowmon product. The CVE does not list specific affected versions, but indicates that any installation where PDF generation is enabled and the product supports user authentication is potentially at risk.

The CVSS score of 8.7 indicates high severity, reflecting a significant impact on the system. The EPSS score is <1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation to date. Exploitation requires an authenticated low‑privileged user, implying that the attack vector likely involves sending a specially crafted PDF generation request from an authenticated session. The rights‑to‑use privilege escalation is limited to contexts where PDF generation is supported and privilege rights are applicable.