## Summary
CVE-2026-50225 describes a weakness in the registration endpoint v1/account/register (/v1/account/register) where no bot mitigation is present. This enables malicious automated systems to flood the database via automated registration requests.
## Technical Details
- Affected endpoint: POST /v1/account/register
- Missing control: no bot mitigation mechanisms on the registration path
- CWE: CWE-306 (Missing Authentication for Critical Function)
- Attack vector: NETWORK
- Preconditions: none indicated beyond reaching the endpoint (NVD indicates PR:N and UI:N)
- Likely behavior: automated registration attempts can create excessive records, stressing storage and application resources.
## Affected
- acer connect m6e 5g firmware versions <= m6e_ai_1.00.000019
## Impact
- Database flooding via automated registration
- High availability impact (resource exhaustion) consistent with A:H
- Integrity impact (unwanted/duplicate or fraudulent records) consistent with I:H
- No confidentiality impact indicated (C:N) and scope is unchanged (S:U).
## Mitigation
1. Patch immediately by upgrading acer connect m6e 5g firmware to a version that includes bot mitigation for /v1/account/register (exact fixed version not provided in the available data).
2. Add server-side bot controls on the registration endpoint, such as rate limiting, request throttling, and abuse detection.
3. Require additional verification for registration (e.g., challenge/response mechanisms) to prevent automated flooding.
4. Monitor for abnormal registration volume and database growth tied to the endpoint v1/account/register and block offending sources.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CWE-306