AntFlow V2.0.0 implements a user identity verification mechanism that relies solely on a userid value extracted from an HTTP request header. Because this value is accepted without additional validation, an attacker can simply forge the header to impersonate any user. This incorrect access control leads to the disclosure of sensitive information that belongs to the forged identity. The weakness aligns with the CWE-639 improper access control category.

The vulnerability affects AntFlow version 2.0.0. No specific vendor information is provided in the advisory, and no precise version range is listed beyond the referenced release.

An EPSS score of <1% indicates a very low, but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 7.5 reflects a high severity, but the low EPSS suggests that exploitation is unlikely; however, the inherent nature of header manipulation indicates that an attacker can trigger the flaw from any HTTP client that can craft custom headers. The impact is global to any instance that accepts unauthenticated headers and can expose confidential user data if the identity assumption is honored by downstream services. Additional constraints would include the need for network‑level access to send HTTP traffic to the target.