An authenticated user who is not a superuser can install a custom package through Ajenti’s auth_users authentication method. This vulnerability provides a weakness where the system fails to enforce proper permissions, and based on the description it is inferred that installing a custom package might allow the attacker to execute arbitrary code or achieve privilege escalation.

The issue affects Ajenti versions prior to 2.2.15. The affected product is Ajenti, a Linux and BSD modular server admin panel, and the problem was fixed in release v2.2.15.

The CVSS score of 7.2 indicates high severity, and the vulnerability requires authenticated access to the Ajenti interface. The CVE description does not specify whether the attack can be performed remotely or locally; it is inferred that if the attacker already has credentials, the exploit could be launched over the network. The EPSS score is not available and the vulnerability is not listed in the KEV catalog, but the potential for privilege escalation warrants prompt action.