An improper authorization check in the file‑serving interface of Arista Networks CloudVision CUE allows an authenticated user to directly reference and retrieve another user's transient data. This insecure direct object reference can expose sensitive network configuration or state information, leading to a confidentiality compromise.

Arista Networks CloudVision CUE, with releases prior to 2026.2.1, are affected by this vulnerability.

The CVSS score of 6.8 indicates a moderate impact. The EPSS score is not available and the vulnerability is not listed in the KEV catalog. Exploitation requires an authenticated network user under specific attack conditions, implying that the likelihood is constrained by those prerequisites. The attack vector is internal but requires valid user credentials.