MRCMS 3.1.2 contains an access‑control flaw in the UserController's save() method, which lacks proper authentication checks. An attacker able to reach the endpoint can create a new user account with super‑administrator privileges without providing credentials, granting full administrative control over the application. This vulnerability falls under the Access Control Weakness (CWE‑284) and can result in unauthorized data modification, denial of service, and disclosure of sensitive information.

The affected product is MRCMS version 3.1.2. No other versions are listed as impacted by this flaw.

The CVSS base score of 9.8 marks this as a critical risk. The EPSS score is below 1%, indicating that large‑scale exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The weakness can be exploited remotely via an unauthenticated HTTP request to the UserController endpoint, allowing anyone with network access to the application to create super‑administrator accounts.