The vulnerability is an insecure direct object reference in the /minerva/moUser/show/ endpoint of MphRx’s Minerva V3.6.0. An authenticated user can modify the numeric identifier in the request URL and retrieve the data belonging to any other registered user, effectively listing users’ profiles. This defies the confidentiality guarantees expected in an authentication‑based system and is classified as a CWE‑284 access control weakness. The primary consequence is unauthorized disclosure of personal or sensitive user information.

The flaw affects MphRx’s Minerva software, version 3.6.0. Any deployment of that edition that exposes the web service endpoint without additional access control measures is susceptible. Administrators should verify that all installations run a version beyond 3.6.0 or have applied corrective controls.

The CVSS score of 8.5 indicates a high severity with exploitation likely executing within an authenticated context. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Because the flaw requires a legitimate user account, the attack vector is internal or compromised accounts, but no privilege escalation is necessary. Once attackers gain convenience of modifying identifiers—whether via credential reuse or brute force—the data of any user can be accessed, making this a serious privacy violation in environments that hold sensitive information.