This vulnerability affects the deepsearcher/agent/collection_router.py file in zilliztech deep-searcher versions 0.0.1 and 0.0.2. Improper access control arises from manipulation of the kwargs argument in the CollectionRouter.invoke function, enabling unauthorized remote access. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality, integrity, and availability impact. A public exploit exists, but no official patch or remediation has been published yet.

Successful exploitation could allow remote attackers with low privileges to bypass access controls and perform unauthorized actions within the affected deep-searcher component. The impact is limited to confidentiality, integrity, and availability to a low degree. No known exploits in the wild have been reported beyond the public exploit code availability.

No official fix or patch is currently available. A pull request to address the vulnerability is pending acceptance. Users should monitor the vendor's repository or advisory channels for updates and apply the fix once it is officially released. Until then, consider restricting network access to the affected service to trusted users only to reduce exposure.