OpenBao's ACL engine incorrectly orders wildcard grants, allowing a parent path that permits LIST to override a more specific child path that denies LIST when the request includes a trailing slash. Based on the description, it is inferred that an attacker who can access a parent path may enumerate secrets in the denied child path, effectively bypassing intended access controls and gaining unauthorized visibility of protected data.

The vulnerability affects OpenBao versions prior to 2.6.0. These releases contain the ACL evaluation logic that permits broader wildcard grants to override more specific deny rules for LIST operations.

The CVSS score is 6, indicating a high severity but not critical. Exploitation would require an authenticated LIST request to the affected path; based on the description, the likely attack vector is a remote API request, and the EPSS score is not available. This vulnerability is not listed in the CISA KEV catalog. The impact is a privilege escalation that enables enumeration of unauthorized secrets.