Free5GC's Unified Data Repository (UDR) service includes a logic flaw that causes the handler for GET /nudr-dr/v2/application-data/influenceData/subs-to-notify to return an HTTP 400 error when required query parameters are missing but fail to stop execution. The subsequent processing continues, retrieving the full list of Traffic Influence Subscriptions and appending sensitive SUPI and IMSI values to the response body. The attacker does not need any authentication to exploit this path, resulting in a privacy‑breaching disclosure of highly sensitive subscriber identifiers that undermines the 3GPP SUCI concealment mechanism at the core network level.

The vulnerability affects Free5GC versions 4.2.1 and older, specifically the UDR service. An unauthenticated attacker with network access to the 5G Service‑Based Interface can trigger the flaw by sending a standard HTTP GET request to the vulnerable endpoint.

The flaw carries a CVSS score of 7.5 (High). No EPSS score is published, and the issue is not listed in the CISA KEV catalog. Because the vulnerability is exploitable over the network without authentication, an attacker can send a parameter‑less or malformed snssai GET request and immediately receive the list of subscriber identifiers, making exploitation trivial for anyone with network visibility to the service.