AntFlow V2.0.0 implements a user identity verification mechanism that relies solely on a userid value extracted from an HTTP request header. Because this value is accepted without additional validation, an attacker can simply forge the header to impersonate any user. This incorrect access control leads to the disclosure of sensitive information that belongs to the forged identity. The weakness aligns with the CWE-284 improper access control category.

The vulnerability affects AntFlow version 2.0.0. No specific vendor information is provided in the advisory, and no precise version range is listed beyond the referenced release.

No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The lack of a known exploit score and official KEV status means the exploitation probability is currently uncertain, but the inherent nature of header manipulation suggests that an attacker can trigger the flaw from any HTTP client that can craft custom headers. The impact is global to any instance that accepts unauthenticated headers and can expose confidential user data if the identity assumption is honored by downstream services. Additional constraints would include the need for network-level access to send HTTP traffic to the target.