The flaw in Agentis creates a user enumeration vulnerability by producing observable differences in responses that allow an attacker to determine which usernames or account identifiers exist. The confirmed CVSS score of 7.5 reflects a moderate to high impact when the flaw is successfully used, giving the attacker potential access to victim identities and a foothold for subsequent credential‑based attacks. This weakness is classified as CWE‑204.

The vulnerability affects the Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis product. Versions before 4.8 are impacted; all builds that have not applied the forthcoming 4.8 update remain vulnerable.

Because the issue is triggered by response differences that can be observed remotely, the likely attack vector is through unauthenticated or low‑privilege HTTP requests to the Agentis API or web interface. The EPSS score is not available, and the flaw is not recorded in CISA KEV, but the CVSS rating indicates a significant risk. An attacker who can send arbitrary requests and analyze response codes or timing variations could enumerate accounts, and if authentication is weak, advance to credential guessing or privilege escalation.