A weakness in Vaelsys VaelsysV4 4.1.0’s user creation handler located at "/grid/vgrid_server.php" allows a remote attacker to manipulate input and bypass standard authorization checks during account creation. The vendor’s analysis states that the resulting behavior does not grant any privileges beyond those already permitted to authenticated administrative users; it simply enables account creation that administrators could otherwise perform. Consequently, an attacker may generate additional user accounts but the impact is limited to the authority level of existing administrators, not an escalation to higher privileges.

Vaelsys VaelsysV4 version 4.1.0 is identified as affected. The vulnerability resides in the code path of the vgrid_server.php component responsible for handling user creation. No other versions or products are listed in the advisory.

With a CVSS score of 6.9, this vulnerability is classified as moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation at present, and it is not listed in the CISA KEV catalog. The attack vector is remote, and a public exploit is available, so while the threat is moderate, organizations should be aware that an attacker could create accounts within the administrative scope if the underlying authorization controls are not enforced.