A flawed parameter handling in the submission viewing endpoint allowed any authenticated user to request files belonging to other students, resulting in unauthorized access to potentially sensitive academic work. The weakness originates from an improper scope check on the select_file_id parameter, permitting arbitrary file content retrieval without verifying ownership or course enrollment. Consequently, confidentiality of all submissions is exposed to any user who can use the vulnerable endpoint.

The MarkUs web application, specifically any installation of MarkUsProject:Markus before the 2.9.1 release, is affected. These versions lack the fix that properly scopes file access to the requesting user, thus enabling the described exploit.

The CVSS score of 6.5 indicates a moderate severity, meaning the vulnerability could be leveraged by any authenticated user. However, the EPSS score of less than 1% suggests low current exploit probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only the ability to send a crafted request containing a valid file ID, which can be done through the web browser or via automated scripts by any user logged into the system. No additional privileges or code execution are necessary; the impact is strictly information disclosure.