Black Duck SCA versions prior to 2025.10.0 have an overly broad user role permission configuration. Specifically, users assigned the scoped Project Manager role with Global User Read access can access certain Project Administrator functions that should be restricted. This vulnerability does not allow full system control but may permit unauthorized changes to project configurations and access to sensitive system information.