The vulnerability arises from insecure default initialization of a resource used by the Pandora FMS API, allowing an attacker to bypass authentication and gain full API access. This flaw can be exploited to perform any action that an authenticated user could, potentially exposing confidential data and enabling destructive operations against the monitored infrastructure.

Pandora FMS versions 777 through 800 are affected. The issue was addressed by the vendor in version 802 and in 800.2.

The CVSS score of 9.1 indicates a high severity. No EPSS score is available, and the vulnerability has not been listed in the CISA KEV catalog, but the lack of a mitigation does not reduce the risk. Attackers can target the exposed API endpoint without any additional authentication, making exploitation straightforward provided the system is reachable over the network.