This vulnerability (CWE-863) in Frauscher Sensortechnik FDS 102 version 2.11.0 allows a remote attacker with low privileges and a valid session to submit requests to /api/user/add.php to create accounts with arbitrary role values. This includes roles with the highest privileges, effectively bypassing authorization controls and enabling privilege escalation. The CVSS 4.0 score is 8.5, reflecting high impact due to network attack vector, low attack complexity, and no user interaction required.

An attacker who has a valid session but low privileges can escalate their privileges by creating new accounts with elevated roles, including administrative privileges. This could lead to full control over the application, unauthorized access to sensitive functions, and potential compromise of the system's security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the user creation API endpoint to trusted users only and monitor for suspicious account creation activity.