The weakness in the admin/signup.php component removes required authentication checks during account creation, allowing an attacker to create administrator accounts without credentials. This yields full control over the system through the privileged admin interface. The flaw is exploited via manipulation of the sign argument and can be triggered remotely, with the vulnerability and exploit code publicly available.

The affected product is the food-waste-management-system project by kishor-23. No specific release or version numbers are identified, but continuous delivery is employed, so the issue may persist across releases until a fix is applied.

The CVSS score of 6.9 indicates moderate severity and the lack of an EPSS score makes the exact exploitation likelihood uncertain. The vulnerability is not listed in the CISA KEV catalog, but the publicly available exploit implies that attackers can conduct remote, unauthenticated access. In absence of an official patch, the risk remains moderate with potential for full administrative takeover.