The flaw stems from improper neutralization of a NUL byte during processing of user data, enabling a remote attacker to read any mail account’s calendar and contact information without authentication. The impact is a confidentiality breach, exposing personal or business data such as appointments, addresses, and email lists. The vulnerability does not confer code execution or denial of service; it limits itself to unauthorized data disclosure.

The vulnerability affects installations of WebPros cPanel. No specific version information is provided in the advisory, so all cPanel deployments that have not applied the patch may be vulnerable, regardless of host configuration or custom modules.

With a CVSS score of 8.7, the flaw is considered high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the issue remotely, likely via web or API endpoints that handle calendar or contact data, and do not need to be authenticated as the flaw allows unrestricted access.