An unauthenticated user can call the RC endpoint options/set on rclone, which lacks proper authentication enforcement. By setting rc.NoAuth to true, the attacker turns off the authorization guard for many RC methods that normally require AuthRequired:true. This is an example of CWE‑15 (Improper Access Control) and CWE‑306 (Authentication Exception), allowing the attacker to invoke privileged administrative functions, such as changing configuration and running operational RC commands, without a valid authentication token.

Any deployment of rclone version 1.45.0 through the pre‑1.73.5 releases that is started with the RC server enabled is vulnerable. The vulnerability affects the rclone command‑line tool distributed by the rclone project and is not limited to any particular operating system or host configuration.

The CVSS base score of 9.2 reflects the severity of gaining unauthorized administrative access. An EPSS score of 33% indicates a moderate likelihood that this flaw is actively exploited. The flaw is not listed in CISA’s KEV catalog, but the remote attack vector combined with no authentication requirement makes it attractive for attackers who expose the RC interface publicly.