A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted API request.