The Wertheim SafeController Software version AssemblyVersion 6.15.8328.28014 suffers from missing authorization checks (CWE-862) on several web application endpoints. This flaw allows authenticated users with low privileges to reach endpoints that are not exposed in the user interface but remain accessible directly. Exploiting this vulnerability, an attacker can perform unauthorized actions including changing the user's branch context, uploading arbitrary files to the system, downloading arbitrary files, and viewing sensitive information about other branches. The CVSS 4.0 base score is 8.6, indicating a high severity with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality and integrity. There is no vendor advisory or patch available at this time, and the software is not a cloud service.

An attacker with minimal authenticated privileges can bypass intended authorization controls to perform sensitive operations such as switching branches, uploading and downloading arbitrary files, and accessing detailed information about other branches. This can lead to unauthorized data access, potential data manipulation, and compromise of system integrity within the vault room management environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected software to trusted users only and monitor for unusual activity related to branch switching and file operations. Avoid exposing the management interface to untrusted networks.