Qool CMS 2.0 RC2 contains a cross‑site request forgery flaw that enables attackers to forge POST requests to the /admin/adduser endpoint. By supplying parameters such as username, password, email, and level, an attacker can create a new user with root‑level privileges without the victim’s knowledge, thereby compromising the administrative control of the web application. This weakness, classified as CWE‑79, permits full administrative takeover once an authenticated user is tricked into visiting a malicious site.

The vulnerability affects Qool CMS 2.0 RC2, the only version specified by the CNA. No additional versions or patch information is provided, indicating that all installations running this release are potentially exposed.

The CVSS score of 6.9 reflects moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. This flaw is not listed in the CISA KEV catalog, implying it is not currently a widely used exploit. The likely attack vector is a remote web‑based CSRF attack that requires a victim to be logged in with administrative privileges when visiting an attacker‑controlled page.