A flaw in FlexNet Manager Suite 2025 R1 and R2 allows an attacker to obtain attachment files without proper authorization due to insufficient access control. The weakness, classified as CWE‑284, permits users who can reach the affected component to request and download any stored attachments, potentially revealing confidential documents, logs, or proprietary data. Because the flaw resides in a web‑based service, the breach would affect the confidentiality of information stored within the system.

The vulnerability impacts Flexera’s FlexNet Manager Suite on Windows platforms. Affected installations include the 2025 R1 and R2 editions, and may also cover the 2026 R1 release as indicated by the CPE entries.

The CVSS score of 7.1 indicates a medium‑to‑high severity risk. The EPSS score is not available, so the likelihood of exploitation cannot be quantified precisely, and the flaw is not listed in the CISA KEV catalog, suggesting no known active exploitation yet. The attack vector is inferred to be remote, leveraging the web interface that serves attachment content; an attacker would need network access to the management system, and could exploit the lack of proper permission checks to retrieve arbitrary files.