This vulnerability affects the OnlineController.getOnlineInfo function in the aceModules/ace-admin/auth/controller/OnlineController.java file of wxiaoqi Spring-Cloud-Platform versions 1.0, 2.2, and 3.0. The flaw is due to missing authorization checks, which can be exploited remotely without user interaction or elevated privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. The vendor has not yet issued a fix or advisory, and the exploit code has been publicly released.

The vulnerability allows remote attackers to bypass authorization controls in the affected function, potentially exposing sensitive online session information or related data. The impact is considered medium severity due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. No confirmed active exploitation in the wild has been reported.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's channels for updates. Until a patch is released, consider restricting access to the affected function or implementing additional authorization checks at the application or network level to mitigate unauthorized access.