The vulnerability permits an attacker to read configuration data or sensitive documents stored by Library Corporation LS2 Admin through the export function, leading to a breach of confidentiality. This information exposure is caused by a missing authentication check for privileged export operations, identified as CWE-306, which allows unauthorized requesters to trigger data exports.

Library Corporation LS2 Admin, versions 5.7 through 5.8.0, that are deployed in enterprise installations.

The CVSS score of 7.5 reflects a high impact on confidentiality. The EPSS score of <1% indicates a low probability of exploitation, and the vulnerability is not listed in CISA KEV. The flaw is likely exploitable by sending crafted requests to the /admin/locationConfiguration/export or /scripts/TlcIndigo/ls2admin/Control/ExportReportControl.js endpoints. If authentication controls are weak, unauthenticated users could obtain data; otherwise, an authenticated user could use this feature to export confidential information. The enterprise environment that stores sensitive operational data faces a moderate to high risk due to potential confidentiality loss, whereas the chance of exploitation remains low.