The vulnerability resides in the getAccessibleAIEmployee() function, allowing any authenticated user to override the role-derived filter and retrieve AI employees that are not assigned to them. This break of authority lets attackers exploit the dispatch-sub-agent-task tool to run ungranted AI employees and use get-ai-employee to read their prompts and tool configuration. The weakness is a classic authority bypass, classified under CWE-863, resulting in unauthorized access to data and the ability to manipulate AI employee behavior. The impact is potential data leakage, incorrect AI responses, and misuse of system resources by users who should not possess those permissions.

Vendor nocobase, product plugin-ai, versions 2.1.0 through 2.2.41 are susceptible. Any deployment of these version ranges should be treated as vulnerable.

The CVSS score of 7.1 indicates a moderate to high severity vulnerability. Exploitation requires a valid authenticated account, and the attacker can trigger the flaw by sending a crafted username to the getAccessibleAIEmployee() endpoint. Although EPSS data is not available, the lack of listing in CISA KEV suggests no publicly reported exploits yet, but the nature of the attack vector—authenticated API calls—means an attacker with day‑of‑login privilege could act immediately. The vulnerability remains actionable once the user is logged in, and the attacker can then use the provided tools to execute ungranted AI employees.