The flaw is a race condition between a check for existing onboarding completion and the creation of a user account, allowing an attacker to exploit a check‑then‑act vulnerability (CWE‑362). If the check passes, the system creates a new user with full ReadWrite admin permissions without any authentication or authorization guard. The result is that an unauthenticated user can gain administrative control over the nginx‑ignition instance, enabling tampering with configuration, deployment of malicious extensions, or persistence of backdoors.

The vulnerability affects the nginx‑ignition web interface, specifically versions prior to 2.41.1 released by lucasdillmann. No other products were explicitly listed. Users of any nginx‑ignition deployment running an earlier release are exposed.

CVE‑2026‑61628 scores 8.1 on the CVSS scale, indicating that the issue introduces high severity. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. An attacker can reach the POST /api/users/onboarding/finish endpoint from any network that can communicate with a pre‑onboarding nginx‑ignition instance, which includes both public internet access and untrusted internal networks. Because the request does not require authentication, the initiator can send concurrent requests to create multiple admin accounts in a single race.