CVE-2025-34467 describes a denial-of-service vulnerability in ZwiiCMS before version 13.7.00. The issue arises from improper locking behavior combined with insufficient authorization checks on multiple administrative endpoints. When a low-privilege authenticated user requests an admin page, the system incorrectly acquires a temporary lock on the resource despite denying access (returning 404). This lock remains associated with the attacker's session and prevents legitimate users from accessing the affected functionality until the session terminates or the attacker leaves the page.

The vulnerability allows an authenticated low-privilege user to cause a denial-of-service condition by locking administrative resources, effectively blocking administrators and other users from accessing certain functionality. This could disrupt administrative operations but does not allow privilege escalation or data compromise according to the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user access to administrative endpoints and monitor for unusual locking behavior. Avoid relying on the affected versions in production environments.