An authenticated user can delete any other user or create new accounts with administrator privileges in OpenPLC V3 because the REST API only checks for the presence of a JWT token and does not verify the caller’s role, exposing a missing authorization flaw (CWE‑862). The result is a local or remote user with normal permissions can gain full administrative control, delete administrators, or create new admin accounts, compromising confidentiality and integrity of the system.

OpenPLC V3, the standalone open‑source PLC simulator and runtime platform. The product is listed as end of life and only the V3 version is affected.

The vulnerability scores an 8.7 on the CVSS scale, indicating a high severity. The EPSS score is not available, and the issue is not recorded in CISA’s KEV catalog, but the required attack conditions are simple: an attacker must authenticate to the REST API. Once authenticated, the flaw can be exploited with minimal effort to elevate privileges, making it a significant risk for any environment that still runs OpenPLC V3 and relies on the default administrator account.