This vulnerability (CWE-862) arises from missing authorization checks in the backend of the CashDro 3 web administration panel. The backend trusts the frontend for permission enforcement, which can be bypassed by modifying the binary string in the 'Permissions' field of the JSON response. This allows an attacker with limited privileges to escalate to full administrative rights, effectively compromising the entire system management functionality. The CVSS 4.0 base score is 8.6, indicating a high impact with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation results in complete bypass of all authorization restrictions, granting an attacker full administrative access to the CashDro 3 system. This compromises system management capabilities and potentially allows unauthorized control over critical operations. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or remediation guidance is currently available from the vendor. Users should monitor the vendor advisory for updates. Until a fix is released, restrict access to the administration panel to trusted users and networks only to reduce exposure.