The vulnerability in IETF Datatracker before 12.83.0 is an authorization bypass that allows users holding a NomCom role to access records belonging to other committees by providing sequential primary keys. Attackers can use the view_feedback_nominee, view_feedback_topic, view_feedback_unrelated and edit_nominee endpoints to view confidential nominee identities, reclassify feedback, and change nominee email addresses. This flaw is a typical case of Information Disclosure and improper authorization handling (CWE-639).

This issue affects all installations of IETF Datatracker versions earlier than 12.83.0, which are hosted by the ietf-tools:datatracker project and were available via the official GitHub repository before the 12.83.0 release. Any system running those versions may be vulnerable.

The CVSS score of 5.3 indicates medium severity, and the EPSS score is not available. It is not listed in the CISA KEV catalog. The attacker must possess a NomCom account, but once that condition is met, they can enumerate primary keys without further authentication by simply calling the vulnerable views. The exploitation path is straightforward, limiting the risk to the number of users with NomCom permissions. The vulnerability mainly compromises confidentiality of nominee identities and can be used to manipulate feedback data.