Signal K Server allows an unauthenticated attacker to inject an administrator role via the /enableSecurity endpoint, elevating to full administrator privileges. This enables modification of sensitive vessel routing data, alteration of server configurations, and unrestricted access to protected endpoints, thereby compromising data integrity and operational control.

Signal K Server versions prior to 2.24.0‑beta.4 are affected. The vulnerability has been fixed in release 2.24.0‑beta.4 and later.

The flaw holds a CVSS score of 9.4, indicating a critical severity. Based on the description, the attack vector is likely a simple HTTP request to a publicly reachable endpoint, meaning an attacker only needs network connectivity to the server. No public exploits are listed and the vulnerability is not in the KEV catalog, but its high severity and ease of exploitation make it a significant threat. Because the EPSS score is not available, the exact probability of exploitation remains unknown.