CVE-2026-50225 is a vulnerability classified under CWE-306 (Missing Authentication for Critical Function) affecting the Acer Connect M6E 5G Portable WiFi Router. The vulnerability arises because the registration API endpoint (/v1/account/register) does not implement bot mitigation or authentication controls, enabling automated systems to submit large volumes of registration requests. This can lead to database flooding, potentially impacting service availability or integrity. The CVSS 4.0 score of 8.8 reflects network attack vector, no privileges or user interaction required, and high impact on availability. No official patch or remediation guidance is currently available from Acer.

The vulnerability allows unauthenticated automated systems to flood the registration database via the /v1/account/register endpoint. This can degrade service availability or cause denial of service conditions by overwhelming backend resources. There is no indication of direct data compromise or privilege escalation from the provided information. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external mitigations such as network-level rate limiting or web application firewalls to detect and block automated registration attempts. Monitor for unusual registration activity. Do not assume the vulnerability is mitigated without vendor confirmation.