The vulnerability arises from improper authorization checks that allow a user lacking sufficient privileges to view and modify confidential information. This access control failure is classified as CWE‑863 and can lead to both confidentiality and integrity compromise if exploited. The CVSS score of 9.1 reflects a high severity, indicating that an attacker could gain significant benefit from successful exploitation.

Acronis Cyber Infrastructure is impacted for builds before 6.0.1‑112, 6.1.1‑64, or 6.2.1‑71. Any installation using these older builds remains vulnerable.

While the EPSS score is not available and the vulnerability is not yet listed in CISA’s KEV catalog, the very high CVSS rating signals a serious risk if the flaw is forced. The description does not specify the exact exploitation method; thus, the attack vector is inferred to involve components of the application that assemble or expose data without enforcing the proper authorization protections. The potential for exploitation remains theoretically high until the vulnerability is addressed.