In Android CarDevicePolicyService, the method setUserDisclaimerAcknowledged lacks a permission check (CWE‑862: Missing Authorization) that allows a local attacker to bypass the user confirmation dialog when adding an account to a managed device. This missing check lets the attacker gain elevated privileges on the device without any need for user interaction or additional execution rights, potentially enabling the creation or manipulation of accounts with administrative privileges.

Android devices that incorporate Google's CarDevicePolicyService, such as Android Automotive OS installations, are affected. No precise version is listed, so the issue potentially applies to any installation that includes this service.

The vulnerability is exploitable locally and requires no external interaction, making it a high‑risk local privilege escalation. The CVSS score of 5.9 indicates moderate severity, while the EPSS score of <1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no confirmed exploitation is documented. The absence of a user interaction requirement and the local nature of the flaw suggest that a malicious actor with physical, user, or local software access could immediately compromise the device.