The Metasploit Framework web service API contains a missing authentication flaw that allows anyone to POST a new user when the users table is empty. During the initial bootstrap, the authentication function bypasses all checks because the framework is not yet initialized, permitting the creation of an administrator account by an unauthenticated caller. This flaw enables complete takeover of the instance without needing valid credentials, severely compromising confidentiality, integrity, and availability.

The vulnerability applies to Rapid7 Metasploit Framework, specifically to versions released before 6.5.9. Only the initial deployment state when the database has no users is required – the flaw disappears once an administrator account exists.

With a CVSS score of 7.3, this issue represents high risk and can be abused without network-level authentication. The EPSS score is not available and the vulnerability is not listed in CISA KEV, but the exploitation path is straightforward: send a POST request to /api/v1/users while the users table is empty. An attacker can immediately gain full administrative control of the Metasploit service by exploiting this design flaw.