An improper access control vulnerability in the multi-factor authentication (MFA) feature of ManageEngine SharePoint Manager Plus (SPMP) allows a low-privileged authenticated user to bypass authorization checks. This enables reading and modifying MFA settings, enabling or disabling MFA, enumerating MFA-enrolled users, and deleting MFA-enrolled accounts. Exploitation could weaken authentication protections or cause denial of service by locking out legitimate users. The issue was fixed in build 4507; the vulnerability was demonstrated in build 4506.