The vulnerability arises from an authorization flaw in the Centreon API endpoint /centreon/api/latest/configuration/users. Because the system does not enforce proper object‑level checks, any authenticated user can query the endpoint and receive configuration data belonging to other users, leading to the disclosure of potentially sensitive information. This issue is classified as a Missing Authorization flaw (CWE‑862) and can impact confidentiality for all users who rely on the API.

The affected product is Centreon, specifically its configuration API. The correct vendor/product is Centreon: Centreon. No specific version numbers are listed in the advisory; therefore any recent deployment of Centreon that includes the latest configuration user endpoint can be affected until further clarification or a patch from the vendor is released.

The CVSS score of 6.5 indicates a medium severity. EPSS is not available, so the likelihood of exploitation in the wild cannot be quantified; nonetheless the vulnerability is already known and the vendor has not listed it in the CISA KEV catalog. Attackers would need to authenticate with valid credentials before accessing the endpoint, so the risk profile is limited to compromised or legitimate user accounts. In absence of a public exploit, the risk remains moderate, but organisations should validate exposures for all authenticated API traffic.