free5GC's NEF component exposes the 3GPP PFD‑management API without requiring inbound OAuth2 or bearer‑token authentication. An attacker with network access to the NEF Service‑Based Interface can send HTTP requests containing any forged bearer token, for example \"Authorization: Bearer not-a-real-token\", and thus create, read, or delete PFD‑transaction state. This flaw allows an adversary to modify policy‑filter‑detail data used for traffic analytics and billing, potentially leading to privacy violations, incorrect accounting, or denial of service if critical PFD records are tampered with. The weakness is categorized as CWE‑862, Unchecked Input for Authorization.

All releases of free5GC before version 4.2.2 are affected. The vulnerability persists even when the ServiceList configuration does not declare the PFD‑management route group, because the HTTP endpoint remains reachable. The only remedy is to upgrade to version 4.2.2 or later, where proper bearer‑token validation is enforced.

The CVSS base score is 9.4, indicating a critical severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The attack vector is remote network‑based; any host that can reach the NEF SBI interface can abuse the unauthenticated API by forging a bearer token. Exfiltration or manipulation of data requires no privileged credentials or user interaction, making exploitation straightforward for an attacker who can reach the service.