IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.6 permit a local attacker to read sensitive information because a service account is granted excessive permissions. The flaw is a classic privilege escalation scenario where inadequate access controls allow the attacker to exploit the account to access data they should not see. The vulnerability is catalogued as CWE‑250 and would enable the attacker to exfiltrate confidential information if they can log into the system or otherwise gain local host access.

The affected product is IBM Aspera Enterprise WebApps on Linux, specifically versions 1.0.0 up to and including 1.0.6. Users running these releases are exposed if the default service account used by the application has more privileges than required for normal operation.

The CVSS score of 6.2 indicates a moderate severity for this local vulnerability, and no EPSS data is currently available. Based on the description, it is inferred that the attack requires local access to the affected system, limiting it to compromised machines or users with local privileges; the flaw is not listed in CISA KEV. The likely attack vector is an attacker with local console or network access that can obtain the service account credentials and then read confidential files or database entries by leveraging the over‑privileged account.