A missing authorization flaw discovered in the QueryEngineTask of Google Cloud Application Integration enables an external attacker to retrieve sensitive internal data. The flaw has a CVSS score of 9.3, indicating high severity, and it permits unauthorized access to information that should be protected by existing controls. Because the vulnerability stems from a lack of proper access checks, an attacker could read data without needing valid credentials, potentially exposing confidential data.

Google Cloud Application Integration, versions between 2025‑04‑28 and 2026‑04‑04. Workflows that contain any QueryEngineTask (ASIS_TEMPLATE) tasks are affected; these tasks can be invoked from external traffic and are the direct entry point to the vulnerability.

The CVSS score of 9.3 reflects the significant impact of the flaw, while the EPSS score is not available and the vulnerability is not listed in CISA KEV. An attacker can exploit the vulnerability by invoking a QueryEngineTask over an external connection; no additional prerequisites are indicated, so the attack can be carried out by any external party with network reach to the integration. Because the issue is a missing authorization check, the attack vector is likely remote over the network and does not require credential compromise.