The vulnerability lies in tsi-dpdp-cms’s JSON Schema Validation component. An attacker can manipulate the _func argument in a request, triggering an information disclosure that exposes sensitive data. This flaw is classified under Information Exposure (CWE-200) and Improper Access Control (CWE-284). The exposed data may be accessed remotely, making it a serious issue for systems that rely on the component for trusted operations.

Affected products are tsi-coop’s tsi-dpdp-cms versions 0.5.0, 0.5.1, and 0.5.2. These versions expose the vulnerable JSON Schema Validation endpoint. The fix is included in version 0.5.3, which removes the flaw by enforcing proper validation and access controls. The vendor promptly released the update after the issue was reported.

The CVSS score of 6.9 rates the vulnerability as moderate severity, and while the EPSS score is not available, the public release of the exploit indicates a non‑negligible probability of real‑world attacks. The attacker does not need local access; the flaw can be triggered remotely by sending a specially crafted request. Because the flaw is enumerable without authentication, any system that exposes the JSON Schema Validation endpoint to the internet is at risk until patched.