The vulnerability in rclone allows an unauthenticated user to modify the global runtime configuration via the options/set endpoint, which lacks authentication. By setting the rc.NoAuth flag to true, an attacker can effectively bypass all authorization checks for RC methods that normally require AuthRequired:true. This exposure permits the execution of privileged administrative commands such as configuration changes, synchronization controls, and potentially arbitrary code execution on the host running rclone. The weakness is classified under CWE-15 (Path Traversal) and CWE-306 (Missing Authentication).

Affected users of rclone versions starting from 1.45.0 up to, but not including, 1.73.5 are at risk. The vulnerability applies to the open‑source rclone command‑line tool distributed by the rclone project.

The vulnerability scores a CVSS of 9.2, indicating high severity, and an EPSS of 6% suggests a modest but non‑negligible probability of exploitation. It is not listed in CISA’s KEV catalog. Since the attack vector is remote and requires no special privileges to initiate, the risk is significant for services that expose rclone’s RC interface without proper authentication.