A missing authorization flaw in the user details controller of pig allows any authenticated user to retrieve the profile of any other user via a simple GET request. The flaw lets attackers gather usernames, real names, phone numbers, emails, linked third‑party accounts, and assigned roles, thereby exposing sensitive personal and organizational data. The underlying weakness is a classic invariant violation of the privilege model.

pig-mesh’s pig application, specifically versions through 4.1.1, is affected. No other versions or product lines are mentioned as impacted.

The CVSS base score of 5.3 indicates a moderate severity. The EPSS score is < 1%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, implying a lower likelihood of active exploitation. The attack vector requires the attacker to be authenticated within the system; any user can enumerate sequential IDs to harvest data. No remote code execution or denial of service is possible from this vector.