The vulnerability allows any authenticated user to retrieve the full details of a share link via the GET /a/share/link/{Uuid} endpoint. Because the REST handler fails to perform an authorization check, it exposes sensitive information such as the link hash, download URL, owner identifier, hidden share user login, permission set, download limits, target users, expiry, and whether a password is required. This provides attackers with advanced knowledge of shared resources without permitting actual read access to the underlying data.

The issue is present in Pydio Cells versions 5.0.0 through 5.0.2. Any installation of these releases that has enabled API access to authenticated users is susceptible; the specific product is Pydio Cells.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers only need to be authenticated to exploit this flaw, so the attack vector is internal with no further prerequisites. While it does not grant direct data reads, the disclosed metadata can aid in planning further attacks and reveals confidential share settings. Because any standard user account can trigger the endpoint, the risk to organizations includes potential accidental or intentional misuse of share link information.