The vulnerability allows requestors to send SCIM API calls with URL-encoded path values that are routed correctly but bypass authentication and permission checks. As a result, an attacker can retrieve sensitive user information such as names, email addresses, phone numbers, addresses, external IDs, and roles without any credentials. However, due to additional checks when manipulating data, the attacker cannot modify or delete any user data. This weakness is represented by CWE-288 (Authentication Bypass).

The vulnerability affects Zitadel identity management platforms from version 2.68.0 up to, but not including, 3.4.8 and 4.12.2. The issue is fixed in Zitadel releases 3.4.8 and 4.12.2, so any deployment running a version older than those is susceptible.

The CVSS score is 7.5, indicating a high severity level. The EPSS score is below 1%, suggesting a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the SCIM API endpoint, where an unauthenticated attacker can construct a URL-encoded request to enumerate sensitive user attributes. The risk is primarily data disclosure for the affected systems.