Hitachi Vantara Pentaho Data Integration and Analytics does not enforce ACLs on API endpoints used for platform mail notifications, allowing an authenticated user to potentially invoke critical operations without proper authorization. This weakness aligns with CWE‑732, exposing the system to unauthorized access of sensitive email notifications and related data. The impact is limited to the confidentiality and integrity of notification contents and could enable an attacker to infer system state or manipulate notification workflows.

Versions of Hitachi Vantara Pentaho Data Integration and Analytics released before 10.2.0.6 and 11.0.0.0, including the 9.3.x and 8.3.x series, are affected. The flaw specifically targets API endpoints that handle platform mail notifications.

The CVSS base score is 6.3, indicating moderate risk, and there is no EPSS score available, so the exploit probability is uncertain. The vulnerability is not listed in CISA KEV, suggesting no confirmed widespread attacks as of now. The likely attack vector is network‑based access to the affected API endpoints, but detailed exploitation requirements are not disclosed in the provided information.