The vulnerability allows an unauthenticated user to supply a user-controlled key to the console-survey/api/v1/answer endpoint, enabling enumeration of valid event IDs and retrieval of the entire Q&A history. The data exposed can contain IDs, private URLs, private messages, internal references and other sensitive information that should be restricted to authenticated users. Consequently, the attacker gains privileged access to confidential chat content and can leverage that information for reconnaissance, lateral movement, exploitation of related systems, or direct unauthorized access to internal applications referenced within the chat.

The affected product is ON24 Q&A chat provided by ON24. No version information is supplied, so every deployment of the ON24 Q&A chat service could be vulnerable. The public endpoint responsible for returning past Q&A data is listed in the product’s CPE name.

The CVSS score of 8.7 classifies the issue as high severity, mapping to CWE‑639 (Authorization Bypass by User-Controlled Key). EPSS is not reported, but the absence of authentication and the public exposure of the API make exploitation likely with ordinary HTTP requests. While the vulnerability is not currently listed in the CISA KEV catalog, its potential to expose sensitive data and aid in lateral movement demands immediate attention. Based on the description, it is inferred that the attack vector involves crafted HTTP requests to the unprotected endpoint.