IBM i systems running versions 7.6, 7.5, 7.4, or 7.3 contain a missing authorization check in the Host‑Based Printer Subsystem. The flaw allows an unauthenticated attacker to request and receive sensitive data from the printer subsystem, effectively letting the attacker print files they would normally be denied. This is a confidentiality breach consistent with CWE‑862.

Affected IBM i releases are 7.6, 7.5, 7.4, and 7.3. IBM has issued PTFs for each release: SJ11502 for 7.6, SJ11523 for 7.5, SJ11524 for 7.4, and SJ11522 for 7.3. In addition, if Access Client Solutions is used to create Telnet printer sessions, version 1.1.9.15 or later must be installed after the PTFs; otherwise Telnet printing will fail.

The CVSS score of 4.8 indicates a moderate risk level and, with no EPSS data available, the likelihood of exploitation is uncertain. The vulnerability is listed as not in the CISA KEV catalog, implying no publicly known exploits at this time. The attack vector is remote and requires the ability to initiate a Telnet or similar session with the Host‑Based Printer Subsystem from an external network. Because no authentication is required, an attacker can simply supply malicious print job requests to retrieve data.