A critical authorization flaw in DinukaNavaratna Dee Store 1.0 allows unauthenticated remote attackers to bypass security controls, posing a significant risk of unauthorized system manipulation.

This vulnerability is caused by a missing authorization check (CWE-862) and incorrect authorization (CWE-863) within the application. The flaw is exploitable by an unauthenticated remote attacker, allowing them to interact with functions intended for authorized users.

The ability for an unauthenticated user to perform unauthorized actions directly threatens the integrity and availability of the application. With a CVSS score of 7.3, this high-severity vulnerability could lead to unauthorized data modification or administrative function execution. Such access can result in significant reputational damage and the potential compromise of sensitive store data.

Immediate Action: As no official patch is currently available, users should restrict network access to the application or take the service offline until the vendor provides a security update.

Proactive Monitoring: Review web server and application access logs for unusual patterns, specifically monitoring for unauthorized requests directed at administrative or sensitive endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to sensitive application functions, providing a virtual patch until a formal update is released.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the GitHub issue tracker referenced by the CVE record.

Given that this vulnerability allows for unauthenticated remote manipulation and a public proof-of-concept is available, the risk to exposed instances is substantial. Administrators must prioritize isolating the affected application from public-facing networks until a vendor-supplied patch is implemented to address the underlying authorization failures.