SkyPilot fails to confirm that an authenticated user has permission to grant administrator-level roles when modifying service account permissions. This flaw allows an attacker to create a new service account, elevate it to an administrator role, and use its bearer token to obtain full administrative control over every user and workspace. The weakness leads to unauthorized access and potential takeover of all resources managed by the platform, compromising confidentiality, integrity, and availability.

The affected product is SkyPilot, identified by the vendor organization skypilot-org. No specific version information is listed in the CVE data, so any deployments running SkyPilot may be vulnerable until a fix is applied.

The vulnerability has a CVSS score of 8.7, indicating high severity. EPSS data is unavailable, so the exact likelihood of exploitation is unclear. It is not listed in the CISA KEV catalog. The attack can be carried out remotely by an authenticated user who can create and manage service accounts; the required exploit path is to submit privileged API requests that lack proper role validation. Overall, the risk is high for installations without a patched role-checking mechanism.