OpenViking versions up to 0.1.18 contain a broken access control flaw that lets unauthenticated users obtain ROOT privileges when the root_api_key setting is absent. The flaw permits attackers to send calls to protected administrative endpoints without any authentication header, enabling them to manage accounts, perform resource operations, and modify system configuration.

The vulnerability affects all installations of Volcengine OpenViking through version 0.1.18, i.e., any deployment running 0.1.18 or earlier. No newer versions are explicitly listed as affected, and the patch commit is available in the repository history.

The CVSS score of 9.3 indicates a critical severity, yet the EPSS score is less than 1%, suggesting a very low current exploitation probability. The vulnerability is not in the CISA KEV catalog. Attackers would need to send HTTP requests to the OpenViking API’s protected endpoints without authentication headers, a step that can be inferred from the description.