The vulnerability arises from insufficient validation of access controls, allowing an attacker to read protected data they are not authorized to see. The weakness is classified as CWE-863, indicating a flaw in access control checks.

Acronis Cyber Protect 17 running on Linux and Windows is affected for builds prior to 41186. Builds 41186 and later include the fix, and no other platforms are documented as impacted.

The CVSS base score of 4.3 indicates moderate severity, while an EPSS score of less than 1% signifies a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits. Based on the description, it is inferred that exploitation could occur through local privilege misuse or via exposed APIs that fail to enforce proper access controls.