A flaw in the User Update Endpoint of z‑9527 admin allows an attacker to send the isAdmin parameter with the value 1, causing the server to create object properties whose names are resolved at runtime. This dynamic property creation bypasses normal input validation and permits an attacker to alter essential user attributes, potentially granting elevated privileges or modifying user data without authorization.

The vulnerability is known to affect z‑9527 admin versions 1.0 and 2.0 through the /server/routes/user.js endpoint. Systems running these specific versions should evaluate whether the endpoint is exposed to untrusted traffic and assess their exposure to the described issue.

The CVSS score of 5.3 indicates moderate severity, and no exploit prevalence score is provided. Exploitation can occur remotely via the HTTP interface to the user update endpoint, and publicly available proof‑of‑concept code exists. While the vulnerability is not catalogued in the CISA Known Exploited Vulnerabilities list, the remote nature and lack of restrictions make it a potential risk for privilege escalation if it remains unpatched.