Zephyr’s Bluetooth host incorrectly enforces the permissions of a characteristic declaration instead of the characteristic value during GATT notify or indicate operations. Because the declaration is always readable with no security requirement, an attacker can obtain the protected characteristic value over an unencrypted or unauthenticated link. This leads to information disclosure and violates the intended access control restrictions set by the application. The flaw is a CWE-863 authorization issue and does not involve memory corruption or denial of service.

The vulnerability exists in the Zephyr real‑time operating system’s Bluetooth host stack. Any Zephyr build that includes the Bluetooth host API prior to the patch (commit c3386f92fe81bd10dc23e6a115e6a80a7d863546) is affected. Devices using Zephyr’s Bluetooth implementation for GATT services that expose encrypted or authenticated characteristics are at risk.

The CVSS score is 6.5, indicating a medium severity weakness. The EPSS score is not available and the entry is not listed in the CISA KEV catalog. An attacker can exploit the flaw by simply connecting to the target device over Bluetooth, writing the Client Characteristic Configuration descriptor to enable notifications or indications, and receiving the characteristic value without having established an encrypted or authenticated link. No privileged access or special conditions are required, making the exploitation straightforward for remote attackers on the same RF range.