CVE-2026-24178 is an authorization bypass vulnerability in NVIDIA's NVFlare Dashboard component of the FLARE SDK. The issue arises from improper handling of a user-controlled key within the user management and authentication system, allowing unauthenticated attackers to bypass authorization controls. This can result in full compromise scenarios including privilege escalation, data integrity violations, information leaks, remote code execution, and service disruption. The vulnerability affects all versions prior to 2.7.2. Although the CVSS 3.1 base score is 9.8 (critical), no official patch or remediation level has been documented by NVIDIA as of the published date.

Successful exploitation of this vulnerability can lead to critical impacts such as unauthorized privilege escalation, tampering with data, disclosure of sensitive information, execution of arbitrary code, and denial of service conditions. These impacts affect confidentiality, integrity, and availability of the affected system. Since the vulnerability allows unauthenticated attackers to bypass authorization, the risk is elevated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to the NVFlare Dashboard to trusted networks and users only, and monitor for any unusual activity related to user management. Avoid exposing the affected versions to untrusted networks. Follow NVIDIA's advisories for updates on patches or official mitigations.