An incorrect authorization vulnerability exists in the acmailer CGI product by Extra Innovation Inc. This vulnerability allows a user with some level of privilege to create a sub-account that possesses administrative privileges, effectively escalating their access rights. The CVSS 3.0 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and the vulnerability is not related to a cloud service.

Successful exploitation could lead to unauthorized creation of administrative sub-accounts, resulting in full administrative control over the affected system. This compromises confidentiality, integrity, and availability of the system and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the acmailer CGI interface to trusted users only and monitor for suspicious account creation activities.