SolarWinds Serv-U contains a CWE-639 authorization bypass vulnerability where a user-controlled key can be manipulated to gain unauthorized access to accounts. This insecure direct object reference flaw requires the attacker to be authenticated but can result in full account takeover. The vulnerability affects Serv-U installations, with Windows deployments experiencing reduced impact. No official patch or remediation guidance has been provided by the vendor at this time.

Successful exploitation allows an authenticated user to bypass authorization mechanisms, leading to complete compromise of user accounts. This can result in full control over affected accounts, including confidentiality, integrity, and availability impacts. The impact is less severe on Windows deployments, but remains critical overall.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for suspicious activity related to account access. No vendor-provided mitigation or temporary fix is currently documented.