The vulnerability resides in the iControl SOAP interface of F5 BIG‑IP and allows an attacker who has authenticated credentials to read personal information of other accounts on the same system, potentially exposing sensitive data. The flaw is a classic example of broken authentication and authorization (CWE‑266).

F5 Networks BIG‑IP appliances are affected; the exact product versions are not specified in the advisory, although only supported releases that have not reached End of Technical Support are evaluated.

The CVSS score of 7.1 indicates a moderate to high impact severity. The attack requires valid credentials but permits cross‑account data access, which could be leveraged for further privilege escalation or information gathering. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, but it should still be mitigated promptly due to its authentication bypass nature.