The flaw allows an attacker to retrieve any database records, including usernames and passwords, by sending a specially crafted DWR request containing a workflow rule. Amplified by a separate authentication‑bypass vulnerability, the same request can be used without credentials. While only read operations have been confirmed, the underlying flaw also permits data writes and deletions, though they have not been exercised. The consequence is the exposure of highly confidential information and the potential for data corruption or loss.

The vulnerability affects Eptura's Archibus software. Specific affected versions are not listed in the public advisory, so all deployed installations should be reviewed for unpatched releases.

The CVSS score of 8.5 reflects high severity, and although the EPSS score is not provided, the existence of a known authentication bypass that can be chained indicates a realistic exploitation pathway from a remote web interface. The vulnerability is not yet listed in the CISA KEV catalog, but its impact on data confidentiality is significant, making it a priority for remediation.