Progress Software MOVEit Automation contains a flaw where default permissions are set too broadly, enabling an attacker to retrieve embedded sensitive data. The vulnerability is rooted in improper access controls, specifically the way the system assigns rights to newly created resources, which allows users beyond intended scopes to read confidential information. This can lead to significant confidentiality breaches, as non‑authorised parties may access content that should be protected.

Clients running MOVEit Automation versions earlier than 2025.0.11 or any 2025.1.x release before 2025.1.7 are affected. Versions 2025.0.11 and newer, as well as 2025.1.7 and newer, contain the fix.

The CVSS score of 6.5 classifies the flaw as moderately severe. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed widespread exploitation to date. While the CVE text does not explicitly state exploit requirements, it suggests that default permission settings could allow non‑authorised users to read data. Based on the description, it is inferred that the vulnerability could be leveraged by any actor who gains non‑elevated access after a successful authentication, but the CVE does not confirm exploitation without special privileges. The risk remains high due to the potential for data exposure.