The flaw lies in an improper access control check in Blog.Admin’s getinfobytoken API. An attacker who can supply a legitimate administrator token can invoke the endpoint and retrieve sensitive account details, thereby revealing credentials and other privileged information.

Blog.Admin versions 8.0 and earlier are affected. The vulnerability exists in the getinfobytoken interface of these releases, and no public patch has been issued for these versions.

Based on the description, the vulnerability requires possession of an administrative token, and the likely attack vector is remote access to the API endpoint capable of accepting such a token. The occurrence of exploitation is considered high because valid tokens are required, which could be obtained from legitimate use or via token theft; however, the specific attack path is inferred. The CVSS score is not available, EPSS is unknown, and the flaw is not listed in the CISA KEV catalog. Exposure of sensitive administrator data poses a significant confidentiality risk to the affected system.