Miaomiaowu versions before 0.9.3 contain an insecure direct object reference in the /api/user/proxy-provider-configs endpoint that allows an authenticated user to read the configuration data of other users. By iterating the globally incrementing external_subscription_id parameter, a malicious actor can obtain override scripts, filter rules, custom request headers, and health‑check URLs belonging to other accounts, exposing sensitive configuration details and operational hints.

Any installation of the Miaomiaowu application by iluo, compiled before release version 0.9.3. The vulnerability affects all pre‑0.9.3 releases regardless of minor patch level, as no earlier versions enforce proper ownership checks for proxy provider configurations.

The CVSS score of 5.3 indicates a medium severity. Exploitation requires valid credentials and knowledge of the external_subscription_id space, and the attacker must iterate values to discover other users' settings. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no widely observed attacks yet. Because the flaw permits disclosure of potentially sensitive configuration information, the overall risk to confidentiality remains moderate, while the impact on integrity or availability is limited.