In Sage DPW version 2025_06_004 a non‑default configuration enables the Database Monitor diagnostic endpoints. When enabled, these endpoints are accessible without authentication and can return sensitive data such as password hashes and database table names. This flaw compromises confidentiality and could allow an attacker to gain deeper insights into the system, increasing the risk of further exploitation.

Sage DPW 2025_06_004 is affected when the Database Monitor diagnostic endpoints are enabled through configuration changes. The feature is disabled by default in all installations, is not present in the Cloud edition, and was previously enforced as disabled in version 2025_06_003.

The CVSS score of 5.9 denotes moderate severity, and the EPSS score of less than 1 % indicates a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an unauthenticated HTTP request to the diagnostic endpoints, which becomes possible only when the application is configured to enable the feature. If the endpoints are reachable over the network, an attacker can readily retrieve exposed information, leading to credential compromise or additional attacks against the underlying database.