An improper access control flaw in UnoPim allows authenticated users to perform unauthorized mass deletion of product data, posing a significant risk to data integrity and business operations.

The vulnerability is an improper access control flaw (CWE-284) and missing authorization (CWE-862) located within the mass-delete functionality of the application. An authenticated user with limited privileges can exploit this endpoint to delete products they are not authorized to remove.

The ability for unauthorized users to perform mass deletions of product information can lead to severe data loss and operational disruption. Given the CVSS score of 8.1, this vulnerability represents a high-severity threat to business continuity, as it allows users to modify critical product catalogs without the required administrative permissions.

Immediate Action: Update the UnoPim installation to version 0.3.1 or later to implement the necessary authorization checks on the mass-delete endpoint.

Proactive Monitoring: Review application access logs for unusual patterns of mass-delete requests originating from accounts that do not typically possess high-level administrative privileges.

Compensating Controls: If immediate patching is not feasible, restrict access to the application to trusted internal networks and implement strict role-based access control audits to minimize the number of users capable of reaching the vulnerable endpoint.

Public Exploit Available: Unknown.

This vulnerability presents a high risk to data integrity due to the potential for unauthorized, large-scale deletion of product information. Security teams should prioritize updating to version 0.3.1 immediately to close this authorization gap. Organizations currently running older versions of UnoPim should conduct a review of recent product deletion logs to ensure no unauthorized activity has already occurred.