The flaw is in rsync's handling of the auth users directive. The parser tokenizes entries using only commas, so a group name that contains a space is split incorrectly. This causes the associated deny rule to be lost. An authenticated user whose access would normally be denied by an @Group Name entry can connect to a restricted module because the deny rule is silently omitted.

The vulnerability affects all rsync servers running version 3.1.0 up to but not including 3.5.0. The only vendor identified by the CNA is RsyncProject rsync. No other affected products are listed.

The CVSS score of 8.6 indicates a high impact. EPSS is not available, so the exploitation probability is unknown but the omission in KEV suggests no publicly known exploit yet. An attacker who can authenticate to the rsync server, for example via password or key, can use the bypass to reach modules that are otherwise restricted. The likely attack vector is a remote authenticated connection to the rsync daemon, where the attacker supplies a credential that would normally be denied but is allowed through the parsing flaw.