The vulnerability stems from a missing authorization check in the deleteUserAccount JSON‑RPC method. An authenticated low‑privileged user can craft a POST request to /jsonrpc/management and specify any other username, causing that account to be removed without the usual administrative confirmation. This flaw targets confidence in the integrity of user accounts and can lead to denial of service for legitimate users. It is classified as CWE‑862, a lack of proper role‑based access control.

The issue affects JUNG eNet SMART HOME server versions 2.2.1 and 2.3.1. The built‑in admin account is protected, but all other user accounts are susceptible to deletion.

With a CVSS score of 7.1 the vulnerability is considered high severity. The EPSS score of < 1% indicates a currently low exploitation probability; however, the vulnerability remains significant because it is accessible over the network to any authenticated user. KEV does not list this entry, but the exposed endpoint and the credential‑based nature of the attack make it a candidate for opportunistic exploitation. The likely attack vector is remote via the JSON‑RPC interface, assuming the attacker has a valid user credential that does not have administrative privileges.