Eclipse Mnestix Browser versions 1.2.0 up to but not including 2.3.0 had a missing server‑side authorization check that allowed an unauthenticated attacker to perform privileged admin actions. The attacker could alter infrastructure settings and invoke the authenticated AAS Generator backend, effectively changing system configuration without proper authentication. This weakness is identified as CWE‑602 and CWE‑862 and could lead to unauthorized modification of critical settings, potentially enabling further escalation or persistence. The vulnerability carries a CVSS score of 8.8, indicating a high impact if exploited.

The affected product is Eclipse Mnestix Browser. Versions starting at 1.2.0 and continuing through all releases prior to 2.3.0 are vulnerable. No specific patch level is listed except that versions 2.3.0 and newer are presumed safe as they are not included in the vulnerability range.

The CVSS score of 8.8 reflects substantial risk, though the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation campaigns yet. The likely attack vector is through the web-based admin interface, where an attacker can send specially crafted requests without authentication to elevate privileges and change configuration. No additional prerequisites beyond network access to the admin interface have been reported, making the exploit straightforward for a local or remote attacker.