Based on the description, it is from a lack of validation for the sessionId parameter in Thrift RPC query sidestep openSession authentication and receive valid query responses. This allows unauthorized reading of stored time-series data, violating confidentiality, and represents an authentication bypass (CWE-290).

It is inferred that Apache IoTDB versions 1.3.3 through 2.0.7 are affected when the Thrift RPC interface is exposed to a network that an attacker could reach. The vulnerability is present in any release before 2.0.8, regardless of deployment environment, and would be triggered by any client capable of crafting RPC requests.

The assigned CVSS score of 9.1 reflects a high severity due to the confidentiality impact. The EPSS score of less than 1% suggests the overall likelihood of exploitation in the wild is low. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is a remote attacker with network access to the Thrift RPC port, who can forge a sessionId to bypass authentication and retrieve data.