Anchore Enterprise users who can authenticate to the API may issue a request that alters another user's permissions, allowing the attacker to gain increased access to resources and actions. The flaw resides in the user management API and is classified as a Privilege Escalation vulnerability (CWE-648). It does not expose system‑admin rights but can elevate a read‑only user to write level, increasing the potential damage to confidentiality and integrity of managed artifacts.

The affected product is Anchore Enterprise. Versions from 5.11.0 through 5.27.1 and the initial 6.0.0 release are vulnerable. The issue is addressed in release 5.27.2 and 6.0.1.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1 percent suggests a low probability of exploitation at this time. The vulnerability is not in the CISA KEV catalog, and the primary attack vector is through an authenticated API call, implying that an attacker must have valid credentials and API access to exploit it. Once activated, the attacker can modify permissions of other users and thereby expand their own authorization scope. The limited scope of the vulnerability to API misuse, combined with the low EPSS, still warrants prompt remediation.