Unauthenticated requests to the coolercontrold service expose a critical API endpoint that allows viewing and modifying potentially sensitive data. The weakness is a missing authentication check for these endpoints, classified as CWE‑306. Attackers who can reach the HTTP interface may read or alter configuration values, logs, or other protected resources, compromising integrity and confidentiality.

CoolerControl coolercontrold versions earlier than 4.0.0, including all 3.x releases, are affected. The issue exists in the code branch referenced in the advisory, and upgrading to version 4.0.0 eliminates the unauthenticated access.

The CVSS score of 5.9 indicates moderate severity. The exploitability is high for any host that can access the HTTP API, as no credentials are required. The likely attack vector is remote over the network, inferred from the description that the vulnerability is exposed via HTTP requests. EPSS is not available, and the vulnerability is not listed in the KEV catalog, suggesting no publicly disclosed exploits at this time.