The vulnerability resides in OctoPrint 1.0.0 within the API Key Handler component, where the getSettings function can be manipulated to reveal sensitive data, notably administrative API keys. An attacker able to trigger the flaw can retrieve these credentials, granting them full control over the printer management system. The weakness corresponds to CWE‑200 (Information Exposure) and CWE‑284 (Improper Access Control).

OctoPrint 1.0.0 and earlier 2013 releases without implemented access control are affected. Upgrading to OctoPrint 1.1.0‑rc1 or later resolves the issue by gating the endpoint and requiring appropriate permissions.

The disclosed exploit is publicly available and can be performed remotely, as the vulnerable /api/settings endpoint was previously unprotected. The CVSS score of 6.9 indicates a moderate severity, and the absence of an EPSS score does not diminish the fact that a publicly posted exploit exists. The vulnerability is not in the CISA KEV catalog, but given the remote nature and known exploitation, it poses a tangible risk to confidentiality for installations exposed to untrusted networks.