A vulnerability was identified in birkir prime versions up to 0.4.0.beta.0 that allows an attacker to manipulate the processing of the /graphql endpoint in the GraphQL API component, resulting in disclosure of sensitive information. The flaw can be triggered remotely, and the exploitation code has been published publicly. This leads to accidental exposure of internal data structures and potentially private user data, compromising confidentiality.

The affected product is birkir:prime, specifically the GraphQL API of the Prime application. Versions up to 0.4.0.beta.0 are vulnerable. No other products or versions were listed as affected.

The CVSS score of 6.9 indicates a moderate severity. EPSS is <1% meaning the likelihood of exploitation is low but not zero. The vulnerability is not listed in the CISA KEV catalog. Attackers can remotely trigger the flaw by sending crafted requests to the /graphql endpoint, and because the exploit is public, systems using an unpatched version are at risk.