This vulnerability in Cfx.re FXServer (versions 9601 and earlier) arises from improper access control on an API endpoint, enabling unauthenticated attackers to access and alter arbitrary user data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. The weakness corresponds to CWE-281 (Improper Access Control). No known exploits in the wild have been reported, and no patch or vendor advisory is currently available.

Successful exploitation allows unauthenticated attackers to read and modify arbitrary user data, compromising confidentiality and integrity of the affected system. There is no impact on availability. This could lead to unauthorized data disclosure and data tampering within the FXServer environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected API endpoint through network controls or other compensating controls to prevent unauthenticated access.