The Eilik NestJS authentication service accepts an account update request that contains a user ID supplied by the caller. Because the handler does not enforce proper authorization, an authenticated user can set the identifier of any other account in the payload and take over that account. The attacker gains full control over the victim’s account, allowing access to personal data, modification of account settings, and use of any resources the valid account normally would have ability to reach. This represents a severe breach of confidentiality, integrity, and availability.

The vulnerability applies to EnergizeLab’s NestJS authentication service, specifically the endpoint used for updating user information. No version details are listed, so any deployment of the service that contains the described code path is considered affected until a patch is deployed. Administrators should verify whether their current deployment includes this code.

The CVSS score of 8.8 classifies the issue as high severity. An EPSS score is not publicly available and the vulnerability is not listed in CISA’s KEV catalog. Because any user who can authenticate to the API can submit an update request, an attacker does not need to bypass authentication; they can simply send the crafted request to take over another user. Given the simplicity of the attack flow and the lack of additional prerequisites, the likelihood of exploitation is significant in environments where the API endpoint is exposed. Prompt remediation is therefore strongly advised.