In free5GC UDR service versions 4.2.1 or older, the endpoint that returns Traffic Influence Subscriptions validates the influenceId path segment but fails to terminate execution after sending a 404. Consequently, it still sends the subscription data in the response body. Because the endpoint does not require authentication, an unauthenticated actor with reach to the 5G SBI can request any influenceId and obtain subscription details such as SUPIs, IMSIs, DNNs, S‑NSSAIs, and callback URIs. This falls under improper authorization and incorrect input validation weaknesses.

The flaw impacts the free5GC implementation of the 5G core network, specifically the UDR (Unified Data Repository) service in releases 4.2.1 and earlier. The affected product is free5GC free5GC, and any deployment that exposes the UDR SBI endpoint without additional protection is susceptible.

The vulnerability carries a CVSS score of 8.7, indicating high severity. EPSS data is unavailable, so the probability of exploitation cannot be quantified, although the flaw allows data disclosure to any actor that can reach the SBI. The issue is not listed in CISA's KEV catalog. Because the attacker does not need credentials and only needs network access to the UDR service, targeted or opportunistic exploitation is likely where network segmentation is weak. Until a patch is released, the risk remains significant.