The flaw is in the management‑authorization gate that uses a substring check on the raw, undecoded request URL. An attacker can encode the path segment %6Dgmt to bypass the check, allowing any authenticated system to access management endpoints and create new system operator accounts, resulting in full administrative control of the local cloud.

Eclipse Arrowhead versions 5.0.0 to 5.2.1 are affected. The vulnerability impacts the Arrowhead management REST API exposed under /…/mgmt/…, including services like the service registry and authentication controller. These require the Arrowhead-common module and spring‑boot‑starter‑security.

The CVSS score of 8.9 indicates a high‑severity flaw. Although an EPSS score is not available, the lack of mitigation in the default configuration and the ability to leverage any authenticated account make exploitation likely. The vulnerability is not listed in CISA KEV, but its exploit path simply requires an HTTP request with a percent‑encoded segment, which any user with network access to the system can craft.