The flaw lies in a report preview endpoint that is marked AllowAnonymous, causing the fallback authorization policy—normally requiring an authenticated administrator—to be bypassed. This oversight allows any caller, even unauthenticated users, to load a project by its numeric ID and view the project's name, description, and the linked client organisation’s name, address, and URL. The vulnerability is a classic example of CWE‑862, Broken Access Control, and results in the disclosure of sensitive engagement information normally restricted to authorized users.

Reconmap, the open‑source penetration‑testing management platform, is impacted. The advisory references code in the API module of the current repository, so any deployed instance running this API code path without the recent patch is at risk. No specific version numbers are listed; therefore, the issue applies to any version that has not yet had the AllowAnonymous attribute removed from the report preview controller.

The high‑severity CVSS score of 8.7 indicates a substantial risk to confidentiality. No EPSS value is provided and the vulnerability is not listed in CISA KEV, but the likelihood of exploitation remains high because the endpoint accepts simple HTTP requests with no authentication required. Based on the description, it is inferred that an attacker could perform a straight‑forward enumeration of sequential numeric project IDs to gather data across all engagements, with each 404 response revealing the existence of missing IDs. The attack vector is therefore a remote unauthenticated HTTP GET to the preview endpoint, with no special privileges or credentials needed.