This vulnerability is caused by missing authorization checks in the AVEZ Electronics Learning Management System. An attacker can exploit incorrectly configured access control to retrieve or modify data that should be restricted, potentially disclosing user information, course content, or internal administrative data and compromising confidentiality and integrity.

The impacted product is AVEZ Electronics Communication Training and Consultancy Trade Inc.’s Learning Management System (LMS). The issue applies to all versions reported through 2026-09-18, as stated by the vendor advisory.

The CVSS base score of 6.5 indicates a medium severity. The EPSS score is not available, so the likelihood of exploitation is uncertain. This CVE is not listed in the CISA KEV catalog. The lack of a public exploit and the nature of the access control flaw suggest that a threat actor with web access to the LMS could craft requests to gain unauthorized data access.