The flaw lies in the event streaming endpoint of Dozzle, which fails to enforce the same label filter applied to container listings. This failure exhibits the weaknesses of CWE-200 Information Exposure and CWE-285 Improper Authorization. As a result, an authenticated user with restricted permissions can receive telemetry and lifecycle events for containers outside their authorized label scope. The exposed data includes container names, images, full label maps, and resource usage metrics, though it does not contain actual log contents or environment variables. The vulnerability therefore jeopardizes confidentiality by leaking sensitive container metadata to users who should not see it.

Dozzle by Amir20 is affected; any installation of Dozzle prior to version 10.6.7 is vulnerable. The issue is resolved in the 10.6.7 release and subsequent versions.

The CVSS score is 4.3, indicating moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires a valid authenticated account, as it leverages the existing authentication system. Because the data exposure impacts only internal container telemetry and not executable code or privileged functions, the overall risk is moderate but should be addressed promptly to prevent accidental disclosure of container metadata to users who should not see it.