The mCarFix Motorists App is vulnerable to unauthorized account creation and data exposure, which allows unauthenticated attackers to manipulate user records and compromise private information.

This vulnerability involves improper access control within the application, enabling unauthenticated attackers to bypass verification processes and manipulate sequential numeric identifiers to access sensitive user data and groups.

Successful exploitation leads to significant privacy breaches and unauthorized access to user accounts. With a CVSS score of 7.5, this high severity flaw poses a substantial risk to user trust, potentially resulting in large-scale account impersonation, data theft, and misuse of the platform, which could lead to severe reputational and legal consequences for the vendor.

Immediate Action: Since a specific patch is not yet identified, administrators and users should restrict usage of the application until the vendor provides a secure update.

Proactive Monitoring: Review backend authentication logs and database records for anomalous registration patterns or unauthorized access requests tied to sequential identifier manipulation.

Compensating Controls: Implement strict API rate limiting and server-side validation for account registration to mitigate the risk of automated or bulk account creation.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the security researcher's technical write-up.

Given the high CVSS score and the presence of a public proof-of-concept, this vulnerability must be treated with urgency. Users and administrators should monitor the vendor for the release of version 2.3.1 or higher and apply all security updates immediately upon availability to close these critical access control gaps.