The vulnerability is an improper privilege management flaw in the user management API endpoint (/api/users/{username_or_id}) of rdiffweb. An authenticated user can send a POST request to modify the role parameter and elevate themselves to an administrator. This flaw directly compromises the confidentiality and integrity of the system by allowing uninformed users to gain elevated privileges, thereby enabling full control over the application.

The flaw affects rdiffweb deployments by ikus-soft. No specific version exclusions were provided in the advisory, so all currently deployed releases that contain the affected endpoint are considered vulnerable.

With a CVSS score of 8.8 the vulnerability is high severity. The attack requires the attacker to be an authenticated user, and the exploit relies on the API accepting a role value that is normally restricted to administrators. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. As a result, the risk is considered significant for systems without proper monitoring, although the exploitation window is limited to users with valid credentials.