The flaw lies in FastApiAdmin's reset_api_docs endpoint defined in init_app.py. Remotely callable actions can trigger the function, and the manipulation can result in information disclosure. Based on the description, it is inferred that the exposed data may include internal documentation or configuration details. The vulnerability is associated with CWE-200 (Information Exposure) and CWE-284 (Improper Access Control).

FastApiAdmin component up to and including version 2.2.0 is vulnerable. Any deployment exposing the reset_api_docs endpoint to external users, regardless of hosting environment, is affected.

The CVSS score of 6.9 denotes moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. Nevertheless, a public exploit script is available, and the attack vector is remote via the exposed endpoint. The issue is not listed in the CISA KEV catalog, but the potential leakage of confidential data warrants prompt attention. The primary impact is a loss of confidentiality, with no known immediate escalation to higher privileges.