The free5GC implementation of the 5G core network contains a flaw in the NEF component where the nnef‑pfdmanagement API route group is mounted without enforcing OAuth2 bearer‑token authentication. By sending HTTP requests with any bearer token to endpoints such as GET /applications, GET /applications/{appID}, POST /subscriptions, or DELETE /subscriptions/{subID}, an attacker who can reach the NEF Service Based Interface (SBI) can read personal flow information data and create or delete PFD change‑notification subscriptions. This grants unauthorized disclosure of user flow data and manipulation of subscription state, although it does not provide code execution or full network takeover. The weakness is a classic "incorrect authorization" (CWE‑863).

free5GC (free5gc) versions before 4.2.2. The vulnerability is present in the NEF component of the open‑source 5G core implementation prior to the 4.2.2 release; it has been fixed in 4.2.2.

The CVSS base score of 10 indicates that exploitation is trivial for an attacker with network access to the NEF SBI. EPSS is not provided, and the vulnerability is not included in the CISA KEV catalog, but the lack of authentication means that any host with connectivity to the NEF service can construct forged bearer tokens and gain the described privileges. The attack vector is purely network‑based; no privileged local access is required. Given the severe impact and zero‑click requirement from a reachable endpoint, remediation must be performed immediately to prevent uncontrolled disclosure or subscription modification.