The vulnerability allows an authenticated user with a Reader role to obtain sensitive information, constituting a data disclosure issue stemming from improper access controls (CWE-200). The attacker can read protected configuration or application data that should be restricted, potentially exposing confidentiality of the system.

The affected product is IBM WebSphere Application Server Liberty, specifically releases from version 17.0.0.3 through 26.0.0.10 that lack the latest security fix pack.

The CVSS score is 6.5, indicating moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, meaning no confirmed exploitation reports in use today. Because the exploit requires authentication as a Reader role, the risk depends on the existence of such accounts and the sensitivity of the data they can access. Remedying the issue by applying the Liberty Fix Pack 26.0.0.11 mitigates it.