Fudo Enterprise API endpoints fail to enforce proper authorization, allowing users with limited privileges to retrieve administrative data such as system logs and configuration settings. This flaw provides direct access to sensitive information, compromising confidentiality and potentially exposing operational secrets.

All installations of Fudo Security Fudo Enterprise running versions 5.5.0 through 5.6.2 are affected. The issue has been fixed in version 5.6.3 and later.

The vulnerability has a CVSS score of 5.1, indicating moderate severity. It is not listed in the CISA KEV catalog and no EPSS score is available. Exploitation requires an existing user account with non-administrative privileges, so attacks are typically internal or on trusted networks where such accounts exist. The attacker can read logs and configuration settings, but the impact is limited to data disclosure rather than system compromise.