The vulnerability arises from insufficient authorization checks in the Data Space Portal backend for self‑registered "PENDING" organization or user accounts between versions 2.1.1 and before 7.3.2. An attacker can create or exploit these pending accounts to gain access to protected endpoints, potentially retrieving or manipulating sensitive data. The lack of proper role validation enables an attacker to bypass authorization controls and may lead to broader system compromise.

The affected product is the sovity dataspace‑portal. All instances running any version from 2.1.1 up to, but not including, 7.3.2 are vulnerable. Users of earlier releases are not affected.

The CVSS score of 10 indicates a critical severity. The EPSS score is not available, but the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is remote, through the public API or self‑registration interface, and does not require prior authentication. Given the absence of mitigation and the critical score, the risk is high and exploitation is feasible for an attacker willing to create a pending account.