The vulnerability allows an unauthenticated attacker to send a PUT request to the /signalk/v1/api/sourcePriorities endpoint and change the priority of GPS, AIS, or other sensor data sources. Because the change is persisted, the attacker can permanently alter which sensors are trusted, potentially steering navigation decisions without detection. The weakness is a lack of authentication and improper authorization, leading to configuration tampering.

SignalK Server versions prior to 2.24.0-beta.1 are affected. This applies to all deployments of SignalK Server that expose the default HTTP endpoint for source priority configuration.

With a CVSS score of 6.9 the vulnerability is Medium‑High severity. The EPSS score is below 1%, indicating a low current exploit probability, and it is not listed in the CISA KEV catalog. The attack vector is remote over HTTP; the attacker needs only network connectivity to the server and no special privileges.