This vulnerability affects Gambio versions up to 4.9.2.0 and involves a flaw in the password reset functionality. An attacker who knows the target account's ID can bypass the intended password reset process and directly set a new password for that account. This bypass does not require any privileges or user interaction, making it a critical security risk. The vulnerability is classified under CWE-640, indicating improper implementation of password recovery mechanisms. Although a patch was mentioned for version 2024-02 v1.0.0 for GX4 v4.0.0.0 to v4.9.2.0, no explicit patch or remediation details are provided in the current data.

Successful exploitation allows an unauthenticated attacker to take over arbitrary user accounts by setting new passwords, leading to full account compromise. Confidentiality and integrity of user accounts are severely impacted, but availability is not affected. This could result in unauthorized access to sensitive information and potential further abuse of compromised accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is confirmed, restrict access to account ID enumeration if possible and monitor for suspicious password reset activities. Avoid relying on the vulnerable password reset mechanism. Follow vendor updates closely for an official patch or mitigation instructions.