P4 Search, formerly known as Helix Search, contains an API flaw that returns stored user credentials in cleartext to any account with administrative privileges on the connected P4 Server. This flaw exposes account passwords and allows an attacker who gains or already possesses administrative access to elevate their privileges further by reusing the disclosed credentials. The vulnerability is a credential disclosure incident categorized as CWE-1220.

The affected product is Perforce P4, also referred to as Helix core. All releases up to and including 2026.4.2 are impacted, while the issue was resolved in the 2026.4.3 release.

The CVSS score of 8.5 indicates a high severity risk. The EPSS score is less than 1 %, suggesting a low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires that an adversary obtain administrative privileges on the P4 Server, either through existing credentials or by exploiting another vulnerability. Once an administrator account is compromised, the attacker can retrieve cleartext credentials from the configuration API and use them to escalated or gain broader access. The exploitation complexity is low for an administrator user, making the requirement of administrative access the primary limiting factor.