An authorization bypass flaw allows a remote attacker to supply a trusted IP address in the X-Forwarded-For or Client-IP headers and have the service accept it as REMOTE_ADDR, thereby impersonating an authorized client. Because the PSI_ALLOWED check trusts these headers before the actual remote address, an unauthenticated user can gain read access to sensitive system details such as hostname, kernel, CPU, memory, file system structure, and network interface information. The weakness is rooted in improper input validation and authentication enforcement, identified as CWE‑290, and can be exploited without prior authentication.

Any installation of phpSysInfo from version 3.4.5 and earlier, regardless of operating system or PHP version. The flaw exists in the read_config.php component of phpsysinfo and applies to all web deployments that expose the script. Versions 3.4.6 and newer have the fix in place.

With a CVSS score of 7.5 the vulnerability is high severity, and although no EPSS score is published, the lack of authentication requirements and the need only to send HTTP requests mean it is readily exploitable on exposed instances. The flaw is not yet listed in the CISA KEV catalog, but remote attackers can easily craft the necessary headers to trigger the bypass. Successful exploitation would provide an attacker with confidential system information that could be leveraged for further attacks.