A file export endpoint in Toptech TMS7 and TopHAT allows any unauthenticated attacker to send a crafted POST request that exports arbitrary database tables. The flaw grants direct access to potentially sensitive data without authentication, representing a critical data exposure vulnerability. The impact is that confidential information stored in the database can be retrieved by an external party, leading to privacy violations and potential regulatory non‑compliance.

The vulnerability affects Toptech Systems products TMS7 and TopHAT. All releases prior to version 7.8 are exposed to the flaw. The security advisory indicates that the issue was fixed in release 7.8; customers running earlier versions remain vulnerable.

The CVSS score of 10 places this flaw in the critical severity tier. Although an EPSS score is not available, the public advisories and the absence of a CISA KEV listing suggest that the exposure is known but not yet a widely documented exploit. Attackers can leverage the unauthenticated HTTP POST interface to exfiltrate data from any remote system that hosts the affected services. The lack of authentication requirements and the simplicity of the request make exploitation straightforward for an adversary with network access to the management interface.