The vulnerability is an improper control of interaction frequency that allows brute‑force attempts against Pusula Communication’s Expert Mail service. By repeatedly requesting authentication, an attacker can enumerate user identities and access personally identifiable information. This weakness directly exposes sensitive data and violates privacy requirements.

Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. provides a product called Expert Mail. The flaw is present in all releases of Expert Mail up through September 18, 2026. Systems running that version or earlier are vulnerable.

The CVSS score of 5.3 indicates a moderate risk level. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that large‑scale exploitation has not been documented. The likely attack vector is a remote brute force against authentication endpoints, which can occur over the public network. If an attacker can repeatedly attempt logins, they may enumerate PII until rate limiting, if any, is applied.