The vulnerability in Nokia MantaRay NM is an improper access control flaw that allows an attacker with valid credentials to retrieve sensitive information beyond their assigned permissions. The flaw arises from insufficient authorization checks within the API layer, meaning that the system fails to verify that the authenticated user is allowed to access the requested data. An attacker exploiting this issue can achieve unauthorized disclosure of confidential data, compromising the confidentiality of the system.

The affected product is Nokia MantaRay NM. No specific version information is provided by the CNA, so all installations of the product are potentially impacted until a vendor‑issued fix is applied.

The CVE lists a CVSS score of 6.5 and an EPSS score of < 1%, and it is not cataloged in the CISA KEV, indicating either a lack of publicly known exploitation or insufficient data on exploit likelihood. Based on the description, the attack vector is likely an authenticated API request; the attacker must first obtain legitimate credentials, after which they can misuse the access controls to read data they should not see. While the exploit requires authentication, the ability to bypass authorization grants a significant impact by exposing privileged information.