This vulnerability in ETSI OSM affects multiple versions and permits a remote authenticated attacker to escalate privileges through the /osm/admin/v1/users API endpoint. The CVSS 3.1 base score is 7.1 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vulnerability is categorized under CWE-269 (Improper Privilege Management). No vendor advisory or patch information is provided, and no known exploits in the wild have been reported.

An attacker with valid authentication credentials can escalate their privileges, potentially gaining higher-level access than intended. This can lead to unauthorized access to sensitive information (high confidentiality impact) and limited modification of data (low integrity impact). Availability is not affected. The vulnerability could compromise system security by allowing privilege escalation via a specific administrative API endpoint.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /osm/admin/v1/users component to trusted users only and monitor for suspicious privilege escalation attempts. Follow vendor communications closely for updates on patches or official mitigations.