This vulnerability is a missing authorization check that allows an authenticated user with low privileges to attach an arbitrary service account to a virtual machine they own. After attachment, the attacker can query the Instance Metadata Service to retrieve an OAuth2 token for that account. The attack is limited to the attacker’s own project only; cross‑project and cross‑organization access is prevented by the STACKIT Identity Provider’s strict project matching during token impersonation. The privileges the attacker can exercise are bounded by the IAM roles assigned to the targeted service account.

The affected system is the STACKIT IaaS API. No specific versions are listed, so all releases that include the servers service‑accounts endpoint are potentially impacted.

The CVSS score of 7.7 indicates high severity. The EPSS score of <1% indicates a very low probability of exploitation. As the vulnerability is only usable by authenticated users and is confined to their own project, the overall risk remains high severity but the likelihood of active exploitation is low. The vulnerability is not listed in the CISA KEV catalog. The lack of an official fix means administrators should apply temporary controls until a vendor patch is issued.