The CVE details a flaw in Home Assistant’s Konnected integration. Prior to version 2026.6.0, the integration registers an HTTP endpoint, KonnectedView, that is marked as not requiring authentication. Although write requests (POST and PUT) are checked against an access token, read requests (GET) are served by a handler that performs no authentication check. Consequently, any device on the local network can retrieve the alarm‑panel switch state and zone topology, exposing sensitive configuration and operational data. This short‑circuit bypass results in full information disclosure. The vulnerability was fixed in Home Assistant 2026.6.0.

Systems affected are installations of Home Assistant core that include the Konnected integration before the 2026.6.0 release. Any deployment running the older integration library (homeassistant/components/konnected/__init__.py) without applying this version contains the vulnerable endpoint. The issue applies to all versions of the integration bundled with Home Assistant prior to the fixed release.

The CVSS score of 7.6 reflects a high‑impact information‑disclosure vulnerability. No public exploit code is known, and the EPSS score is currently unavailable, but the vulnerability is trivially exploited by any device on the same LAN; no authentication or elevated privileges are required. The lack of proper access control enables attackers to enumerate alarm panel settings and potentially orchestrate future attacks. The vulnerability is not listed in the CISA KEV catalog.