The vulnerability resides in an unspecified function within server/src/index.ts of ai‑genius‑automations octoally. By tampering with the argument to the path parameter, an attacker can read sensitive data that should not be exposed. The flaw enables disclosure of confidential information to the attacker, i.e. it is an information‑disclosure flaw.

All installations of ai‑genius‑automations octoally running any version up to and including v1.0.87 are affected. The fix is available in v1.0.88 and later.

The vulnerability has a CVSS score of 6.9, indicating moderate severity. The attack can be launched remotely and the exploit has already been published in a public repository. Because it is not listed in CISA’s KEV catalog and the EPSS score is not provided, the precise exploitation probability is unknown, but the public availability of the exploit code raises the threat level. The flaw is an example of improper information handling (CWE‑200) and insufficient access control (CWE‑284).