The vulnerability is an incorrect authorization and improper access control flaw in Apache IoTDB, specifically in the /rest/v2/fastLastQuery endpoint. Based on the description, it is inferred that any authenticated user could retrieve last‑value sensor data that should be guarded by authorization checks. The flaw conforms to CWE-284 (Improper Access Control) and CWE-863 (Missing Authorization via Improper Checking of Permissions). Because the data returned by the endpoint can be sensitive, exploitation leads directly to unauthorized disclosure of confidential information.

Apache Software Foundation’s Apache IoTDB is affected. All releases from 1.3.5 up to but not including 1.3.8 in the 1.x series, and all releases from 2.0.5 up to but not including 2.0.10 in the 2.x series, are vulnerable. Users running any of these versions should consider them at risk.

The CVSS v3.1 base score of 7.5 indicates high severity, while the EPSS score of less than 1 % suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that any authenticated user could issue a GET request to /rest/v2/fastLastQuery to gain access to confidential data. The attack requires the attacker to have a valid user account, which may be obtained through standard authentication mechanisms, and then simply call the endpoint.