RansomLook fails to consistently enforce authorization checks on private entities such as groups, markets, and ransom notes. The vulnerability allows an unauthenticated remote attacker to retrieve private group and market names, the content of ransom notes, and metadata such as post counts, mirror totals, and uptime. This constitutes a serious breach of confidentiality and is a classic example of the Missing Authorization weakness (CWE‑862).

All deployments of the RansomLook application are potentially vulnerable because no specific vulnerable version range is provided. Administrators should verify that their installation includes the security patch that implements privacy checks before exposing private data in API responses or web views.

The vulnerability carries a CVSS base score of 9.2, indicating high severity. The EPSS score is not available, so the exact likelihood of exploitation cannot be quantified. It is not listed in the CISA KEV catalog. The likely attack vector is remote, where the attacker issues standard HTTP requests to exposed endpoints such as /compare or other API routes and can supply a private entity name to obtain restricted data. Based on the description, no authentication or user interaction is required for exploitation.