Netatalk 2.2.2 through 4.4.2 contain an authentication bypass flaw that lets a remote privileged user authenticate as any account via the admin auth user mechanism. The flaw is a weakness in the authentication process (CWE-287) and can be exploited to gain higher privileges than originally permitted, compromising system confidentiality and integrity.

The vulnerability affects all Netatalk service deployments running any version from 2.2.2 up to and including 4.4.2. Systems that have not applied any vendor update during that release range remain susceptible.

The CVSS score of 6.4 indicates a moderate severity vulnerability. It can be exploited by an attacker with network access to the Netatalk service and a privileged user account, though further details on exact prerequisites are not provided in the advisory. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog.