The vulnerability allows an attacker who has an active administrator session to reset the password of any other administrator account by specifying that account’s identifier in the password‑update request. Once the password is reset, the attacker can authenticate as the target administrator, thereby gaining full administrative privileges. The flaw stems from an unchecked identifier in the request path not being compared to the authenticated user, a classic Improper Privilege Assignment issue (CWE‑639).

IDURAR ERP CRM versions through and including 4.1.1 are affected. The vulnerability resides in the backend update controller for password changes, and the same identifier misuse exists in the accompanying read handler.

The CVSS score of 8.6 indicates high severity. Exploitation requires only a valid administrative session, which can be obtained through legitimate credentials or compromised sessions. Although the EPSS score is not available, the lack of mitigation from CISA’s KEV catalog does not diminish the potential impact. An attacker who can trigger the password‑reset endpoint can immediately take over any administrator account targets. The attack vector is inferred to be remote and user‑initiated, leveraging the web API endpoints that continue to accept arbitrary identifiers after authentication.