This vulnerability arises from the absence of an authorization check in a configuration Ajax endpoint, allowing any user who can reach the endpoint to retrieve confidential data. The weakness is rooted in missing authorization controls, which is classified as a high‑severity information disclosure that can compromise the confidentiality of the system.

Pandora FMS products, versions from 777 up to 800, are vulnerable to this flaw. The vendor has identified these releases as affected.

The issue scores a CVSS base of 8.4, indicating a high risk to data confidentiality. No EPSS information is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by issuing the specific Ajax request to the configuration endpoint without authentication, enabling them to read sensitive data.