The vulnerability involves a missing authorization check on the Custom Template file endpoint (GET /api/custom_templates/{id}/file). Because any authenticated user can enumerate template IDs, the endpoint allows reading the file content of any custom template, bypassing the intended Resource Control restrictions. The exposed data may include environment‑specific values such as connection strings, API tokens, or registry credentials that administrators do not expect ordinary users to view. This flaw corresponds to CWE-862 (Missing Authorization).

Portainer Community Edition is affected. Versions from 2.33.0 up to, but not including, 2.33.8, as well as 2.39.1, contain the flaw. The issue is resolved in releases 2.33.8 and 2.39.1. The product is used to manage Docker, Swarm, Kubernetes, and ACI environments.

The CVSS score of 6.0 classifies the vulnerability as Medium severity. EPSS information is not available, so the estimated exploitation probability cannot be quantified. The flaw does not appear in the CISA KEV catalog. An attacker requires authentication but does not need elevated privileges beyond a normal user role, and can exploit the vulnerability by sending HTTP GET requests to sequential numeric identifiers. Successful exploitation leads to disclosure of sensitive configuration data. While it does not allow arbitrary code execution, the leakage of credentials can compromise the entire stack.