Portainer Community Edition
Unauthenticated access to specific endpoints is possible during the five-minute setup window of uninitialized instances. A network attacker can exploit this by interacting with the '/api/restore' and '/api/users/admin/init' endpoints to restore a crafted backup or create the initial administrator account, resulting in full administrative access.