The vulnerability permits an attacker to bypass authorization by controlling a key that is used for trusted identifiers. This flaw enables the attacker to gain access to privileged resources or perform actions normally reserved for higher‑privileged users. The weakness is a classic authorization bypass scenario, aligning with CWE‑639.

Enocta Educational Technologies Inc. provides the Enocta Platform, and the platform is affected through the release dated September 28, 2026. All earlier releases of the platform potentially carry the flaw.

With a CVSS Base Score of 8.1, the flaw represents high severity. The EPSS score is unavailable, meaning the exact probability of exploitation cannot be quantified, but the lack of a KEV listing does not mitigate risk for systems that remain unpatched. The likely attack vector is over the web interface of the platform, inferred from its nature as a web‑based educational system; an attacker can manipulate the user‑controlled key within an authenticated session to impersonate an authorized user or elevate privileges.