The vulnerability in CISA's manage.get.gov arises from the ability of an organization administrator to assign domain manager privileges to domains that are not already owned by another organization. This flaw allows an attacker with administrator permissions to grant themselves, or another account, full control over additional domains, effectively escalating privileges and compromising domain management integrity. The weakness falls under privilege management failure, identified as CWE‑266, and could lead to unauthorized control of critical .gov domain registrations and related services.

The affected system is the manage.get.gov platform operated by CISA. All releases prior to version 1.176.0 are vulnerable. Administrators of any organization within the platform could exploit the flaw to elevate privileges on domains within that organization.

The CVSS score of 7 indicates a high severity. Because the attacker must first be an organization administrator to use the function, the risk largely depends on internal threat actors or compromised administrator accounts. The vulnerability is not listed in the CISA KEV catalog and no public exploit has been reported, but unauthorized privilege escalation can have significant impact on domain management and should be addressed promptly.