The vulnerability resides in the a+HRD application, where an authenticated remote attacker can invoke a specific API method that lacks proper authorization checks. This allows the attacker to arbitrarily read sensitive database contents, potentially revealing personally identifiable information and business data. The weakness is classified as CWE‑862, a missing or incorrect authorization control.

This issue affects the aEnrich a+HRD system. No specific version range is provided, so all deployed instances may be vulnerable until patched.

The CVSS score of 7.1 indicates a high severity, though the EPSS score is currently unavailable, suggesting limited public exploitation data. The vulnerability is not listed in the CISA KEV catalog. The attack requires valid user credentials and remote API access; once authenticated, the attacker can read arbitrary database entries. The missing authorization check creates a significant confidentiality risk.