The vulnerability exists in the GET /api/userquery/userinfobackup endpoint of openEQUELLA versions prior to 2026.1, which performs no authentication or authorization checks. An attacker who supplies another user's uniqueId can retrieve that person's stored personal information—username, first name, last name, and email address—within the same institution. This constitutes a confidentiality breach, exposing user-identifying data without any legitimate access rights (CWE‑639).

Apereo Foundation’s openEQUELLA is affected for all releases before 2026.1. No specific patch level is noted beyond the recommendation to upgrade to a vendor‑recommended version.

The CVSS score of 6.9 indicates a moderate severity vulnerability. The exploit requires only a crafted HTTP request to a publicly accessible REST endpoint; no authentication or privileged credentials are needed. As the EPSS score is not available, the exploitation likelihood is unclear, but the lack of access controls makes exploitation trivial. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation at this time.