A missing authorization check in the user deletion endpoint allows any authenticated user to delete arbitrary user accounts, including administrators. This flaw enables an attacker who can authenticate—either by using valid credentials or compromising an account—to remove administrative access, potentially disabling critical service functions and facilitating further exploitation. The weakness is a lack of proper authorization controls, identified as CWE-862.

The vulnerability affects the Anitya application. No specific version information is supplied, so all deployments potentially impacted should verify if the delete_user endpoint lacks administrator verification.

The CVSS score of 7.1 indicates a high severity. EPSS data is not available, and the issue is not listed in CISA KEV, but the lack of authentication enforcement means any legitimate authenticated user can exploit the flaw. The attack vector is inferred to involve the authenticated API or UI path that calls the delete_user endpoint, with no prerequisite to be an administrator. Because the flaw permits deleting admin accounts, the impact on confidentiality and availability of the service is significant if an attacker removes essential administrative controls.