The vulnerability is a forced browsing issue in Apache Axis2/Java that allows anonymous callers to retrieve service metadata from multiple routes. Because the exposeServiceMetadata enforcement was missing on several endpoints, attackers can obtain WSDL, XSD, OpenAPI JSON, Swagger UI resources, MCP catalog entries, the services listing, WS-MetadataExchange GetMetadata responses, and the ping module outputs. This disclosure reveals operation names, request and response schemas, and other internal details. The weakness is identified as CWE‑425.

The affected vendor is the Apache Software Foundation. The product is Apache Axis2/Java. All releases through version 2.0.1 are affected; version 2.0.2 and later have the fix.

The likely attack vector is remote HTTP requests to the exposed metadata routes, requiring no authentication or special privileges. Exploitation is trivial once the server is reachable. The CVSS score is not provided in the data, and EPSS is not available, so a numerical risk estimate cannot be given. The vulnerability is not listed in the CISA KEV catalog, but the exposed service details could aid subsequent attacks, making the risk significant for publicly exposed Axis2 services.