The flaw allows a delegated user administrator to issue an empty password to the update_user endpoint, leading to a bypass of the reserved user guard and enabling the attacker to assume the superuser account with no credentials. This results in full control over the Wazuh Manager, violating confidentiality, integrity, and availability of the entire system.

All Wazuh Manager installations from version 4.6.0 up to, but not including, 4.14.8 are vulnerable. The affected product is the Wazuh Manager component provided by the Wazuh vendor.

With a CVSS score of 8.6, the vulnerability is considered High severity. Because the update_user API is exposed via the Wazuh REST interface, remote attackers who can reach the endpoint and possess delegated administrative privileges could exploit the flaw. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS suggests the potential impact is significant if accessed by a malicious actor.