This vulnerability is a missing authorization check that permits an authenticated user with low privileges to attach any high‑privilege service account to a virtual machine they own. By unvalidated PUT requests to the servers service‑accounts endpoint, the attacker can then query the Instance Metadata Service to obtain OAuth2 tokens. This effectively bypasses tenant boundaries, giving the attacker control over the entire organization environment and enabling arbitrary code execution, data theft, or further infrastructure compromise.

The affected system is the STACKIT IaaS API. No specific versions are listed, so all releases that include the servers service‑accounts endpoint are potentially impacted.

The CVSS score of 9.3 indicates critical severity. EPSS is not available, but the lack of an official fix and the possibility of exploitation by any authenticated user suggest moderate to high likelihood of use. The attack requires only low‑privilege credentials and the ability to send HTTP requests to the API, which are commonly available in compromised environments. There is no listing in the CISA KEV catalog at present, but the mechanism of bypassing tenant isolation is similar to threats that have appeared in KEV, so vigilance is advised.