When requested, the sdbootutil script creates a debug log at /var/log/sdbootutil.log. The log file is writable with permissions 0644, making it world-readable, a flaw that arises from improper file‑permission configuration (CWE‑732). This allows any non‑privileged local user to view the file and potentially extract secrets or other sensitive data stored there, thereby compromising system confidentiality for all local users.

The vulnerability affects SUSE Linux Enterprise Server 16.1 and SUSE Linux Enterprise Server for NVIDIA 16.1 as well as openSUSE Leap 16.1 and openSUSE Tumbleweed.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. Exploitation requires the ability to trigger the sdbootutil script locally; once triggered, any user can read the world‑readable log and gain unauthorized information. No remote exploitation path is documented.