This vulnerability in HYPR Server (versions 9.5.2 through before 10.7.2) involves an authorization bypass via a user-controlled key, enabling privilege escalation. The issue is categorized under CWE-639, which pertains to authorization bypass due to improper validation or control of user-supplied keys. The CVSS 4.0 vector indicates the attack requires physical access (AV:P), low complexity (AC:L), no attack vector (AT:N), and privileges required (PR:L) without user interaction (UI:N). The vulnerability impacts confidentiality, integrity, and availability at a high level. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

Successful exploitation could allow an attacker with some level of privileges to escalate their privileges by bypassing authorization controls through manipulation of a user-controlled key. This could compromise the confidentiality, integrity, and availability of the affected HYPR Server. However, exploitation requires physical access and some privileges, limiting the attack surface. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict physical access to systems running affected HYPR Server versions and limit user privileges to the minimum necessary. Monitor for vendor updates regarding patches or official mitigations.