The vulnerability allows an attacker to trick a logged‑in administrator into submitting a hidden form that creates a new user with full administrative rights. This is a classic CSRF flaw, classified as CWE‑352, that permits the addition of accounts with arbitrary credentials without explicit user permission, thereby enabling privilege escalation and compromising administrative control.

All installations of bloofoxCMS that are running version 0.5.2.1 are affected. No other product versions are listed as impacted.

With a CVSS score of 6.9 the risk is moderate to high. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. An attacker must obtain a logged‑in user’s session to exploit the flaw; the attack is typically carried out by hosting a malicious page that triggers the hidden form submission. Because the vulnerability relies on standard CSRF techniques, exploitation probability is considered moderate.