This vulnerability (CVE-2025-0640) in Akinsoft OctoCloud arises from improper authorization checks related to user-controlled keys, classified under CWE-639. It affects versions from s1.09.02 up to but not including v1.11.01. The flaw allows an attacker with high privileges to bypass authorization mechanisms, resulting in resource leak exposure. The CVSS 3.1 base score is 4.7 (medium), reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and impacts on confidentiality, integrity, and availability at a low level.

An attacker with high privileges can exploit this vulnerability to bypass authorization controls, leading to exposure of resources that should be protected. The impact includes limited confidentiality, integrity, and availability degradation. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor Akinsoft communications for updates. Until a fix is available, restrict high-privilege access to trusted users only to reduce risk.