What the vulnerability does
01Description
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
CVSS base score
3.8/10
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U
Key dates
02Disclosure timeline
December 19, 2025
CVE published
December 19, 2025
Record updated
External resources
