The vulnerability is a broken access control flaw where an attacker can send a crafted HTTPS POST request that sets a session variable used for authorization. When the optional Job Performance (SUPReMM) module is enabled, the attacker can override the intended restrictions and access other users' compute job efficiency metrics. This gives the attacker the ability to read confidential HPC usage statistics, potentially exposing sensitive performance data.

OpenXDMoD deployments from the ubccr vendor prior to version 11.0.3 that include the optional Job Performance module are affected.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is 0.00054, indicating a very low probability that this vulnerability will be exploited, and the vulnerability has not been reported as exploited in the wild or listed in CISA KEV. The attack vector is an HTTPS POST request that manipulates a session variable; no special privileges or internal access are required beyond the ability to access the application endpoint. The risk is therefore moderate, mainly due to potential unauthorized disclosure of performance metrics.