The vulnerability arises from an improper authorization check that allows an attacker to access sensitive data that the user should not be able to read. The flaw does not provide code execution or denial of service, but it compromises confidentiality by exposing confidential information to unauthorized parties. The weakness is classified as CWE-863, indicating a failure in access control logic.

Products affected are Acronis Cyber Protect 17 running on Linux and Windows operating systems. Versions before build 41186 are vulnerable; newer builds contain the fix.

The CVSS score of 6.5 places the issue in the Medium severity range. The EPSS score of less than 1% indicates a very low likelihood of exploitation at present. The vulnerability is not yet listed in the CISA KEV catalogue. Attackers would need to compensate for the missing authorization guards, which likely requires some level of authentication or local access, but the exact attack vector is not detailed in the advisory and is inferred from the nature of the flaw.