An authenticated user can exploit an improper access control check on the /api/v1/sources/{id}/image-url endpoint in migration‑planner. The flaw allows the attacker to bypass the ownership verification and retrieve a presigned S3 URL for an Open Virtual Appliance image that belongs to another user. Downloading that image can expose long‑lived agent JSON Web Tokens, source configurations, and other sensitive data, potentially granting the attacker unauthorized access or the ability to modify the victim’s source.

The affected product is migration‑planner. No specific version range is listed by the CVE, so all versions that have not been patched for this flaw are considered vulnerable.

The CVSS score of 9.6 reflects a high impact vulnerability with a requirement for user authentication. The EPSS score is not available, and the issue is not currently listed in the CISA KEV catalog. The likely attack vector is over the network by an authenticated attacker who can directly call the vulnerable API endpoint. Because the flaw permits the download of privileged artifacts, it can lead to significant confidentiality breaches and potential compromise of source configurations.