The documented vulnerability in BLUVOYIX arises because vital internal API documentation is exposed to unauthenticated users. An attacker can send specially crafted HTTP requests to the endpoints revealed by the exposed docs, potentially gaining the ability to manipulate internal processes and data. This flaw allows remote execution of functions that were intended to remain restricted, increasing the risk of data breach or service disruption.

Bluspark Global’s BLUVOYIX product is affected. No specific version information is supplied in the advisory.

The CVSS score of 10 classifies the issue as critical, indicating that success would have a severe impact on confidentiality, integrity, and availability. The EPSS score is less than 1 %, suggesting that real‑world exploitation is not yet widespread, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated remote attacker sending HTTP requests to publicly reachable API endpoints that were inadvertently documented. Proper authentication or network isolation would prevent such exploitation, but as currently exposed, any system to which the API is reachable could be abused.