The vulnerability is a lack of authentication on the /api/player/ lesson endpoints in OpenAEV versions before 2.260622.0. The API accepts a client‑supplied userId parameter without verifying that the caller is that user or a member of the exercise. This allows an unauthenticated user to read lesson questions and answers, including the identity of answer authors, and to create or overwrite answers for any user. The result is unauthorized disclosure of sensitive content and insertion of false data.

Affected systems are installations of the OpenAEV platform before version 2.260622.0. The issue exists on a default installation where the /api/player/ endpoints are exposed without prior authentication. Upgrading to 2.260622.0 or later removes the unauthenticated access and implements necessary authorization checks.

The CVSS score of 8.2 classifies the flaw as a high‑severity vulnerability. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, so the current exploitation probability is unknown but the lack of authentication makes exploitation trivial if the API is reachable. The missing object‑level authorization means an attacker with any network access to the API can read and modify sensitive lesson data. Administrators should assume the vulnerability could be leveraged to compromise the confidentiality and integrity of exercise content.