This weakness (CWE-639) represents an authorization bypass flaw in the updateExtClient endpoint, allowing a user with permissions to manage external clients in one network to tamper with external clients belonging to any network. By sending a PUT request to /api/extclients/{network}/{clientid}, an attacker can replace the public key, disable the client, and retrieve the WireGuard private key of the target client. This creates a serious risk of unauthorized access to the affected network, allowing an attacker to impersonate a legitimate client, intercept traffic, or maintain persistence.

The vulnerability affects the gravitl Netmaker product, versions up to and including 1.7.0. All installations that expose the updateExtClient API endpoint are susceptible and should verify their deployment version.

The CVSS score of 8.7 indicates high severity. The EPSS score is not available, so the exploitation probability cannot be quantified; however, the vulnerability is not listed in CISA KEV, suggesting no current widespread exploitation reports. Attackers need only credentials that grant external client rights, which are typically scoped to a single network, and can exploit the API remotely from any network that the client is reachable from, implying a network-based attack vector.