Taskosaur’s user registration endpoint accepts a role field from the client without validation. Because the service does not reject or modify client‑supplied role values, an attacker can craft a registration request that assigns themselves SUPER_ADMIN privileges. This results in the creation of a fully privileged account, giving the attacker complete control over the platform, including the ability to modify content, access sensitive data, and deploy malicious code. The weakness corresponds to improper authorization and identity management (CWE‑284 and CWE‑639).

The vulnerability affects Taskosaur version 1.0.0. Users running this version of the Taskosaur project management platform are exposed. No other versions are currently known to be affected.

With a CVSS score of 9.8 the risk is critical. The exploit can be performed remotely by sending a crafted HTTP request to the public registration endpoint with no prior authentication, making exploitation straightforward for an attacker. The EPSS score of less than 1 % indicates that widespread exploitation is unlikely at present, but the vulnerability is not listed in the CISA KEV catalog, confirming it is not an actively exploited vulnerability in the wild. Nevertheless, the potential impact warrants immediate attention.