The vulnerability allows an authenticated MQTT client to subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing the configured subscribe permissions that are normally enforced by NATS Server. As a result, the client can read MQTT QoS2 protocol metadata for sessions belonging to the same account, exposing potentially sensitive session information. This illustrates an authorization enforcement weakness (CWE-863).

All versions of NATS Server before 2.12.12 and 2.14.3 are affected. The fix is included in those two releases, so any earlier version remains vulnerable.

The CVSS score of 4.3 indicates a medium impact. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The escalation requires an authenticated MQTT client; the likely attack vector is an actor who has credentials or can create a client under the account, thereby gaining read access to internal QoS2 metadata. Since the issue does not grant arbitrary message publication or remote code execution, the risk is confined to confidentiality leakage of internal messages rather than full control over the server.