Incus before versions 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 has a missing authorization check on the GET /1.0/operations/{uuid} endpoint, allowing clients that hold a restricted certificate and know an operation UUID to read data from other projects. An attacker can retrieve command lines, environment secrets, websocket secrets, and trust enrolment tokens that may contain highly confidential information.

The affected product is Incus from LinuxContainers, with the vulnerability present in any release prior to 6.0.7, 7.0.2, or 7.5.0 respectively. Users running those earlier branches are susceptible.

The CVSS score of 7 indicates high severity. The EPSS score of 0.207% indicates a very low but non-zer exploitation probability. The vulnerability is not currently listed in the CISA KEV catalog. Attackers require an existing restricted certificate and knowledge of a valid operation UUID, which may be discovered through enumeration or other agency. The lack of an authorization guard means that once those prerequisites are met, exploitation is straightforward and can yield non-privileged but highly sensitive data across project boundaries.