Map‑OS versions 5.0.0 through before 5.2.2 contain a privilege escalation flaw in the REST users endpoint that allows operators with the cUsuario permission to bypass both permission‑delegation and super‑administrator protections. By sending authenticated POST, PUT, or DELETE requests to /api/v1/usuarios, an attacker can assign the Administrador group to a user, reset the super‑administrator password, or delete higher‑privileged users, thereby gaining administrator level access or eliminating other privileged accounts.

The vulnerability affects the Map‑OS application from vendor RamonSilva20, specifically the software versions 5.0.0 up to and including 5.2.1. Users running any of those releases are susceptible until the version is updated to 5.2.2 or later, which contains the required fix.

The CVSS score of 8.6 classifies the flaw as high impact; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only an authenticated session with the cUsuario permission, a capability commonly granted to non‑administrator operators. Because the attacker can manipulate user group assignments or reset passwords through simple HTTP requests to the API, the attack vector is likely through web-based or scripted API interactions. No external access components beyond normal API traffic are required, making the exploitation probability significant for environments where non‑admin operators have network access to the API gateway.