Dell ECS versions 3.5 and 3.6 have an Improper Access Control flaw in the Identity and Access Management module. This weakness allows a remote attacker who has not authenticated to obtain read access to data that the victim should not see. The impact is the exposure of confidential information and potential data leakage, with a CVSS score of 5.9 indicating moderate severity.

Dell Elastic Cloud Storage (ECS) configuration versions 3.5 and 3.6 are affected. Any deployment of these versions that has the IAM module enabled and accessible from an external network may be vulnerable.

The vulnerability can be exploited over the network by sending specially crafted IAM requests; authentication is not required, so the attack surface is broad. Based on the description, it is inferred that the attacker does not need to authenticate to gain this access. The EPSS score is not reported, but the CVSS score of 5.9 reflects a notable risk for data confidentiality. The CVE is not listed in the CISA KEV catalog, indicating that there have been no confirmed exploits in the wild yet, yet the potential for misuse remains high for organizations still running the affected versions.