Description
A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Frauscher Sensortechnik | FDS 102 | 2.11.0 – ≤ 2.13.3 | — |
Advisories 1
- VDE-2026-078 Frauscher: FDS102 for FAdC/FAdCi R2 has multiple vulnerabilities CERT@VDE · Aug 20, 2026