ScadaLTS 2.8.1-release-candidate build 0 contains an authorization bypass vulnerability in its handling of DWR endpoints. The Spring Security framework restricts access based on URL path patterns, but DWR dispatches method calls using POST body parameters, which are not properly validated. The crossDomainSessionSecurity setting is disabled, removing DWR's origin validation. This allows any authenticated user to invoke restricted DWR methods by sending requests to permitted URLs with manipulated POST parameters, enabling privilege escalation and unauthorized actions.