The vulnerability resides in kalcaddle Kodbox 1.64, specifically the shareSafeGroup() function of the shareOut.class.php component. Manipulation of the sk argument forces the function to use a hard‑coded cryptographic key, allowing an attacker who can influence this parameter to generate or read API keys that the system would normally secure. This flaw, a clear‑text usage of a secret (CWE‑320 and CWE‑321), enables unauthorized use of the API, potentially facilitating data export or further compromise of the Kodbox instance.

kalcaddle’s Kodbox product, version 1.64, is affected. The flaw is limited to the shareOut.class.php controller and the shareSafeGroup API endpoint; newer or earlier versions have not been reported as impacted.

The CVSS base score of 6.3 indicates medium severity, yet the vulnerability requires remote initiation with a complex exploitation path, making real‑world attacks less likely at present. The EPSS score is unavailable and the issue is not listed in CISA’s KEV catalog. The attack vector would be over the network to the vulnerable endpoint, but the complexity and lack of publicly available exploit scripts reduce the immediate exploitation risk.