The vulnerability is caused by a partial string comparison performed in the _deduplicate_results function of BettaFish’s InsightEngine search‑result deduplication. Because the code compares only part of the strings, an attacker can submit input that appears duplicate but is actually unique, causing the service to treat distinct records as the same. This flaw allows the insertion of duplicate entries or incorrect data presentation, thereby violating data integrity. The weakness is classified as a partial comparison (CWE‑187) with incorrect comparison logic (CWE‑697).

All deployments of 666ghj BettaFish version 1.2.1 or earlier are affected, as the vulnerable code path resides in the InsightEngine component. Any instance that exposes the Deduplication endpoint without additional controls can be reached by external clients.

The CVSS score of 6.9 indicates a moderate risk level, while the EPSS score of less than 1% shows that exploit activity is currently very low. The vulnerability is not listed in the CISA KEV catalog. The flaw can be triggered remotely via the public Deduplication endpoint, and the exploit has already been disclosed publicly. Until a formal patch is merged, the primary mitigation is to limit external access or implement the temporary local fix.