The vulnerability is an Insecure Direct Object Reference that lets any authenticated user view mod authors' full names and email addresses by navigating to a mod page via its slug. This is a privacy breach that exposes personally identifiable information (PII), violating GDPR requirements. The weakness is categorized as CWE-862, an access control issue. No evidence of code execution or denial of service is provided, so the primary impact is data disclosure rather than system compromise.

Hytale Modding Wiki, versions prior to 1.0.0, are affected. The vendor product HytaleModding:wiki is listed, and the fix was applied in version 1.0.0.

The CVSS score of 4.3 indicates moderate severity. EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires authentication; any user with an account can exploit the flaw by simply visiting a mod page. Because no public exploits are reported, the threat level is that of a low to moderate risk for privacy violations, but it remains technically feasible for any valid user within the system.