The vulnerability in the Open Object API allows an attacker who possesses a valid non‑superuser API token with a read grant on any single ObjectType to retrieve the complete, versioned record of an object belonging to any other ObjectType via the history-detail endpoint. This bypasses the expected authorization checks, enabling disclosure of sensitive data such as citizen or case records. The flaw is an authorization bypass; it is categorized under CWE‑639, which describes an actor gaining access to resources beyond their intended scope.

Affected products are the open‑object package from maykinmedia. Versions 2.4.3 through 2.5.1, 3.6.2, 4.0.2, and 4.1.1 contain the flaw; it is remedied in releases 2.5.1, 3.6.2, 4.0.2, and 4.1.1. The issue is triggered by the GET /api/v2/objects/{uuid}/{index} history‑detail action, and the fix was applied in the commits referenced in the advisory. Systems running any earlier major or minor releases remain vulnerable.

The CVSS score of 6.5 indicates a moderate severity; the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote via the exposed HTTP API. An adversary only needs a legitimate token that has read permission on any object type, which may be obtained through credential compromise, misconfiguration, or token reuse. Because the flaw bypasses per‑object policy checks and returns the full serialized data, it can lead to privacy violations and the exposure of confidential identifiers.