The insecure direct object reference in Cisco Slido’s REST API allows an authenticated attacker to craft requests that reveal other participants’ social profile information or alter quiz and poll results, violating access control and confidentiality as defined by CWE‑639. When this flaw is exploited, an attacker can compromise user privacy and distort the integrity of interactive content.

The vulnerability impacts Cisco Slido. Cisco has addressed this vulnerability in Cisco Slido and no customer action is needed. No information is available regarding Cisco Webex Meetings, so the status of that product is unclear.

The CVSS score is 5.4, indicating medium severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote, authenticated client sending crafted requests to the vulnerable REST endpoint, restricted to users with valid credentials. Cisco has addressed the issue, so no further action is required.