The dataspace-portal product by sovity suffers from a critical authorization vulnerability (CWE-602, CWE-863) affecting versions 2.1.1 through 7.3.1. The backend does not properly enforce authorization for self-registered accounts in a "PENDING" state, relying instead on client-side enforcement. This allows an attacker to bypass intended access controls. The vulnerability is resolved in version 7.3.2. The CVSS 4.0 vector indicates a network attack vector with no privileges or user interaction needed and results in high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an unauthenticated attacker to bypass authorization controls on the dataspace-portal backend, potentially gaining unauthorized access or performing unauthorized actions. The impact affects confidentiality, integrity, and availability of the system, making it critical. No known exploits have been reported in the wild to date.

Upgrade to dataspace-portal version 7.3.2 or later, where this vulnerability has been patched. Since the product is not a cloud service, users must apply this update themselves. Patch status is confirmed by the vendor stating the issue is fixed in version 7.3.2. Until upgrade, restrict access to the dataspace-portal backend to trusted users and networks if possible.