BurgerEditor from versions 3.0.0 through 3.4.0 contains an authorization bypass that permits an authenticated attacker, who can supply a user‑controlled key, to modify page content. The flaw stems from improper validation of the key during authorization checks, enabling unauthorized content alteration as a form of privilege escalation. The vulnerability results in potential compromise of data integrity for users who view the altered content, and is classified as a CWE‑639 type of access control weakness.

Affected systems include D‑ZERO CO.,LTD.'s BurgerEditor product, specifically versions 3.0.0 to 3.4.0.

The CVSS score of 5.3 indicates medium severity. Because the EPSS score is < 1% and the vulnerability is not listed in CISA KEV, the exploitation likelihood is low. The attack vector is likely internal, requiring an authenticated user to supply the key. An attacker could use the key to bypass authorization and modify resources. No vendor‑supplied patches or workarounds are currently disclosed.