The guohongze adminset software up to version 0.61 contains an authorization bypass vulnerability in the Delivery Deployment Endpoint component, specifically in the delivery/deli.py file. By manipulating the project_id argument, an attacker can bypass authorization controls remotely. The vulnerability is tracked as CVE-2026-16217 and is associated with CWE-285 (Improper Authorization). Although publicly disclosed, no patch or official remediation has been released by the vendor as of the publication date.

Successful exploitation of this vulnerability allows an attacker to bypass authorization mechanisms remotely, potentially granting unauthorized access to functionality or data within the affected component. The severity is rated low, indicating limited impact or exploitability based on current information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should monitor official channels for updates. Until a fix is available, consider restricting access to the affected component or implementing additional access controls to mitigate unauthorized use of the project_id parameter.