The vulnerability exists in purocean Yank Note 3.93.0 within the Settings Endpoint’s config.getAll function in index.ts. Manipulating the request to this endpoint can cause the server to return sensitive configuration data that should not be exposed. This information disclosure can include authentication credentials or system details, potentially compromising confidentiality. The CVE description indicates that the attack may be launched remotely, implying a reachable endpoint over the network. This vulnerability is classified as CWE-200 (Information Exposure) and CWE-284 (Improper Access Control).

The affected product is purocean’s Yank Note, specifically version 3.93.0. The vulnerability is fixed in version 3.93.1, as noted in the release notes and the patch commit. The affected component is the Settings Endpoint handling configuration requests. No other product versions are listed as affected.

The CVSS score of 6.9 classifies this vulnerability as moderate severity. The EPSS score is not available, so an exact exploitation probability cannot be quantified; however, the existence of a public exploit raises the practical risk. The CVE description states the attack can be launched remotely, but authentication requirements are not specified, meaning the exploit may be accessible from unauthenticated or authenticated sessions. The exposure occurs when the config.getAll endpoint returns information that should be restricted, making the vulnerability potentially exploitable without additional access controls.