The flaw resides in the UCenter Article Submission Endpoint, where manipulating the id or userId parameters bypasses normal authorization checks. By sending a crafted request, an attacker can submit or modify articles on behalf of arbitrary users, leaking or corrupting content and potentially gaining elevated privileges. The weakness is a classic authorization flaw, classified as CWE‑266 and CWE‑285.

The vulnerability affects the JPress platform, specifically versions up to and including 1.0.3. Any deployment using the /ucenter/article/doWriteSave handler without a fix is susceptible. The issue is reported in the JPress codebase and tracked in multiple vulnerability databases.

The CVSS score of 5.3 indicates a moderate impact; the EPSS score is not available, and the vulnerability is not yet listed in CISA’s KEV catalog. Attackers can trigger the flaw remotely via HTTP requests, and the public disclosure means tools or scripts may already exist. Because the flaw involves improper authorization, it allows an attacker to create or alter content for any user without authentication on the target system.