Improper input validation in the Azure Compute Gallery component allows an attacker with authorized credentials to retrieve sensitive information over the network. The flaw is a classic input validation error, classified as CWE‑20, and the primary consequence is a confidentiality violation where data that should be protected can be exposed.

Microsoft Azure Stack HCI deployments that include the Azure Compute Gallery service are affected. No specific product or version constraints were supplied, so any Azure Stack HCI installation using this component is potentially vulnerable.

The CVSS score of 7.7 indicates a high severity risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that, while the potential impact is significant, there is no current evidence of active exploitation in the wild. Attackers would likely need legitimate credentials to access the vulnerable API endpoints, meaning mitigation should focus on credential protection and network access controls.