The vulnerability permits an attacker to view meeting minutes and transcripts that were intended to be restricted. This results in the disclosure of potentially sensitive internal communications, compromising confidentiality and possibly violating regulatory requirements. The weakness is a broken access control flaw (CWE‑602).

Johnson & Johnson Audit Tracking Management System, prior to the 2026‑04‑21 release. No specific version numbers are identified; the vulnerability exists in all releases before that date.

The CVSS score of 7.5 indicates a high severity. Exploitability was not investigated enough to assign an EPSS score, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need access to the web interface and could exploit the broken access controls; no prerequisites beyond authentication are mentioned, so the risk depends on the access privileges available to the attacker.