UnoPim before version 2.1.3 contains a missing authorization check on integration management routes, allowing any user with basic administrator privileges to create OAuth API integrations, mint client credentials, and elevate permissions. This flaw is a classic example of improper privilege enforcement (CWE‑862) and can enable an attacker to subvert the platform’s security model by generating privileged integrations that bypass role restrictions, potentially compromising application data and exposing sensitive configuration.

The vulnerability affects the UnoPim product (Webkul:unopim) in releases prior to 2.1.3, specifically versions 2.1.2 and earlier. All editions of UnoPim that include the vulnerable Bouncer middleware and missing ACL map entries are impacted.

The CVSS score of 7.1 indicates a high severity, and although EPSS data is not available, the lack of a KEV listing suggests no publicly known exploit, but the flaw can be readily exercised by attackers who acquire minimal admin rights. The missing authorization validation in the Bouncer middleware permits an attacker to execute privileged integration actions without further checks, making exploitation straightforward once an admin account is compromised.