The vulnerability enables authenticated users with low-privilege accounts to call API endpoints that are not authorized for their role. This allows them to access functionality or data beyond their intended permissions, compromising confidentiality and integrity of the access control system.

Hikvision HikCentral Access Control is affected. The description does not specify exact version numbers, so administrators should verify whether their installation is part of the affected releases.

The CVSS score of 7.1 denotes a medium severity risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no widely known exploitation. The attack requires a valid authenticated account, so the risk is mostly confined to users with compromised or misconfigured accounts. Nonetheless, unauthorized API access could be leveraged to obtain sensitive data or alter access permissions.