## It is legal to sell imperfect products ##

The general standard for selling products is that they are required to be fit for the purpose for which they're sold and advertised. They are not required to be a very good fit for the purpose. They are not required to be fit for other purposes. They are certainly not required to be free of all flaws, risks and potential misuses - as long as they are mostly fit for a particular purpose, it is legal to sell them.

For example, it is completely legal to sell doors that can be smashed open by a scrawny teenager. It is completely legal to sell physical locks that can be picked open by a bobby pin. It is completely legal to do so even if you're completely aware that these vulnerabilities exist. These doors and locks are still fit for purpose even if explicitly advertised for the purpose of "keeping intruders out" - they are not required to be *perfect* at that purpose; it's okay to manufacture and sell flimsy doors and flimsy locks even if everybody knows that they could be made much more secure with some modifications.

Pretty much all software is released with known bugs, i.e., the company bug tracking system lists many unfixed problems of varying importance. Again, this is evidence that having known defects by itself isn't sufficient to make software unfit for purpose. Even when released without any known bugs, no software is fully secure - pretty much every nontrivial package has had multiple security vulnerabilities. This doesn't mean that they are not fit for purpose - they certainly allow users to perform useful tasks even if the vulnerabilities are never patched, so they are fit for that purpose even if they are totally unsecure. 

For example, many systems similar to your system (as it looks like from the question) would be quite useful even if they didn't have *any* authentication and all users had full access. In that case it would be fit for purpose even with a totally flawed authentication system; some authentication is better than no authentication and no authentication also would be acceptable in this case - not too good, but acceptable.

One can imagine certain niches of software which are absolutely not useful if their security is flawed. Most software is clearly not in this category, but e.g. disk encryption or password management software could be. However, even then it would be a question of how severe the vulnerability is. As in the example of flimsy locks, an imperfect security solution that protects against some but not all attacks is generally considered fit for purpose.

## Ethics of selling low quality products ##

The ethical situation is a bit different than the legal mandate, but again I believe we can draw parallels from sale of physical items. 

For any given type of product consumers reasonably expect that there will be differences of quality depending on the brand. Some shoes will be much better than others, and it's nice; and some shoes will be much cheaper than others, and that's nice as well - both are valid choices for consumers and manufacturers. 

It's a completely valid and ethical strategy to make and sell low quality items. Someone may reasonably intentionally buy a low quality item, for example, because it's cheaper. Someone may reasonably intentionally choose low quality software, for example, because it's cheaper. People may make, distribute and use free software that is well known to have as much holes as swiss cheese, and simply avoid using it in contexts where security is important. A customer ordering a custom development may reasonably choose to have their supplier work on new features over fixing known security flaws - it is their choice to make, and it's ethical to make a product according to these priorities.

What is unethical is misleading customers. If you want to advertise that your product is better in quality than the competition, then it's ethical iff it actually is so. If you want to advertise that your product will hide sensitive data from authorised local users without proper permissions, then it's ethical iff it actually is true. However, do note that this is talking about the ethics of advertising and communication - the unethical act is not the selling of shoddy software, but the lies about your product.

In your particular example, the ethical way would be to ensure that the vulnerability is publicly disclosed. In that case, the customers can make an informed decision on how and if they should use the product, how important that vulnerability is to them and if it makes a meaningful difference to them. 

All this is assuming that we're talking about defects of various severity, not malicious code - intentionally placing backdoors is strictly different.