This vulnerability in Sunbird DCIM dcTrack v9.1.2 is due to improper enforcement of access control mechanisms. Specifically, attackers can create or update tickets with location data while bypassing RBAC checks, which normally restrict such actions based on user roles. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or official remediation information is currently provided, and there are no known exploits in the wild.

An attacker can bypass RBAC restrictions to create or modify tickets with arbitrary location data, potentially leading to unauthorized changes in the system's ticketing records. This impacts the integrity of the system but does not affect confidentiality or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected version 9.1.2 of Sunbird DCIM dcTrack to trusted users only and monitor for suspicious ticket creation or modification activities related to location data.