DeepAudit, a multi‑agent system designed to discover code vulnerabilities, contains an improper access control flaw on the /api/v1/users/ endpoint. Any authenticated user can query this endpoint and receive a list of all users, including private data such as email addresses, phone numbers, full names, and role information. This flaw leads to sensitive personal and role data being exposed to anyone who has already authenticated to the system, potentially allowing attackers to facilitate further credential‑based attacks or social engineering. The weakness is identified as CWE‑863, improper authorization.

The vulnerability affects lintsinghua DeepAudit, specifically all releases up to and including version 3.0.4. Users running these or earlier versions of the software are at risk and should verify their deployment version.

The calculated CVSS score is 2.1, indicating a low severity. The EPSS score is below 1%, signaling a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Inferred from the description, the likely attack vector requires an attacker to possess valid credentials to the DeepAudit instance. Once authenticated, the attacker can enumerate all users and collect sensitive data without needing any additional privileges.