CVE-2024-54879 describes an incorrect access control vulnerability in SeaCMS version 13.1. The issue stems from a logic flaw that permits unauthorized users to perform member recharge operations indefinitely. This bypass of access control mechanisms can lead to unauthorized privilege escalation or financial abuse within the system. The vulnerability is classified under CWE-281 (Improper Authorization). No known exploits in the wild have been reported, and no patch or official fix has been disclosed at this time.

Successful exploitation allows any user, without proper privileges, to recharge members indefinitely. This compromises the integrity and confidentiality of the system by enabling unauthorized financial transactions or credit allocations. The availability of the system is not impacted. The CVSS score of 9.1 reflects critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user access to recharge functionality through other means such as network segmentation or manual monitoring. Avoid granting recharge permissions broadly and consider additional application-level controls to detect and prevent abuse.