A missing permission check on the user‑confirmation endpoint of Omada Controller in MSP mode allows an attacker who is already authenticated to submit any Identifier value. This grants the ability to verify whether the supplied credentials belong to an existing user, confirm password validity, or authenticate as that user altogether. The flaw can lead to user enumeration and unauthorized account access, expanding the attack surface for lateral movement or targeted compromise within the network management system.

The vulnerability affects TP‑Link System Inc.’s Omada Software Controller running on Windows platforms. No specific version numbers are listed in the CNA data, so all installations of this product that engage the MSP mode are considered at risk until patched.

The CVSS score of 7.5 indicates a high‑severity vulnerability, but the EPSS value is not available, making the current exploitation probability uncertain. The issue is not included in the CISA KEV catalog. Successful exploitation requires the attacker to be authenticated to the controller, implying a prior compromise or legitimate user credential. Once authenticated, an attacker can reliably enumerate users or authenticate as others, potentially granting full control over MSP resources. This is a classic authorization bypass that can be leveraged for privilege escalation or data exfiltration within the managed network.