This vulnerability affects guohongze adminset versions up to 0.61 in the Delivery Deployment Endpoint component, specifically in the delivery/deli.py file. By manipulating the project_id argument, an attacker can bypass authorization controls remotely. The vulnerability was publicly disclosed and reported to the project early, but no remediation or patch has been issued to date. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation allows an attacker to bypass authorization checks related to project_id, potentially granting unauthorized access to restricted functionality or data within the Delivery Deployment Endpoint. This could lead to unauthorized actions or information disclosure within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided and the vendor has not responded, users should monitor for updates from the project and consider implementing additional access controls or network restrictions to limit exposure until a patch is available.