The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key issue. By controlling the `user ID` parameter, remote attackers with regular privileges could access certain features as any user, modify any user's account information and privileges, leading to privilege escalation.