TEN Framework version 0.11.71 contains an authentication bypass flaw in the TMAN Designer file‑content API, allowing attackers to use unprotected POST and PUT requests to read any file on the host or write arbitrary content. By writing files such as authorized_keys, cron jobs, or executable graph definitions, an attacker can achieve code execution with the privileges of the running service. The weakness is identified as an authentication failure (CWE-306).

TEN Framework 0.11.71 all builds that expose the TMAN Designer /api/designer/v1/file-content endpoints without additional access controls. The flaw exists in the core subsystem handling file content operations.

The flaw carries a CVSS score of 9.3, indicating critical severity. The EPSS score is 1%, indicating a low but non-zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the vulnerability by sending unauthenticated HTTP requests to the vulnerable endpoints, making it trivially exploitable in any environment where the API is publicly reachable.