The vulnerability is an improper authorization flaw in the /tequilapi/config/user endpoint of Mysterium Node. Prior to version 1.36.0, the endpoint accepts arbitrary POST requests without any authentication or authorization check, enabling an attacker to overwrite the node’s configuration file. Overwriting the configuration allows the attacker to gain full control of the node, effectively compromising confidentiality, integrity, and availability. The weakness is classified as CWE‑862 (Missing Authorization).

Mysterium Node versions released from 1.21.1‑rc0 up to, but not including, version 1.36.0 are affected. Any installation of these earlier releases is vulnerable if the /tequilapi/config/user endpoint is exposed to network traffic.

The CVSS score of 9.8 denotes critical severity. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low overall exploitation probability at present. Based on the description, it is inferred that the attack vector is a remote network request to the unsecured endpoint, which an unauthenticated attacker could construct and send to overwrite the node configuration and take over the node.