This vulnerability allows an administrator who can approve privacy requests to bypass the subject identity verification process when duplicate request detection is enabled. The result is that erasure policies can be executed without ever confirming the user’s identity, leading to unauthorized removal of a data subject's records across all configured integrations. The weakness involves insufficient authentication and authorization controls, reflected by the CWEs listed.

Ethyca Fides deployments in the open‑source privacy engineering platform, specifically versions from 2.75.0 up to, but not including, 2.83.2. Any installation that has both subject identity verification and duplicate privacy request detection enabled is vulnerable.

The CVSS score of 6.1 indicates a moderate severity vulnerability. With no EPSS score available and the vulnerability not listed in CISA KEV, the public exploitation likelihood is not quantified but is potentially low to moderate. The attack requires privileged administrator access; an attacker who gains such access or compromises an administrator account can exploit the flaw. Consequently, the risk is primarily systemic data loss rather than remote code execution.