RansomLook contains an authorization flaw that allows unauthenticated remote users to export selected internal databases through the /export/<database> endpoint. Some databases are filtered, but others expose records marked as private, including groups, markets, posts, and other sensitive data. This flaw is a classic example of inadequate access control (CWE‑862) leading to the disclosure of private ransomware intelligence, victim information, and internal tracking data.

The vulnerable product is RansomLook from the vendor ransomlook. No specific affected versions are listed, so all current installations may be susceptible unless the legacy export route has been removed or disabled.

The CVSS score of 9.2 indicates high severity, and because unauthenticated users can reach the web application, the vulnerability is remotely exploitable with no authentication required. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request to the export endpoint, which may return private data from the instance. Impact is purely data exposure; no direct code execution or denial of service is implied.