This vulnerability resides in a file of the LettaBot 0.2.0 API implementation and allows an unauthenticated user to access the status endpoint. The missing authentication check combined with the presence of an endpoint that can be queried remotely leads to an authentication bypass (CWE-287, CWE-306). The impact is that an attacker could read status information that may contain sensitive system details, potentially revealing configuration data or other internal states. The exploit is known to be publicly available and can be performed from any external network.

The affected system is the letta-ai LettaBot application, version 0.2.0. No other versions or components were explicitly identified as vulnerable. The vulnerability was detected in the src/api/server.ts file of the API Status Route implementation.

The CVSS score of 6.9 indicates a moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that its exploitation likelihood is uncertain but still possible. Because the attack vector is remote and no authentication protects the endpoint, any external actor with network access to the API can trigger the exploit. The vulnerability does not grant direct control over the system but provides unauthorized access to potentially sensitive status data.