The vulnerability is an improper authorization check in Acronis Cyber Infrastructure that allows a user with any authentic access to disclose and manipulate sensitive configuration data. This flaw can lead to the exposure of confidential information and unauthorized changes to critical infrastructure settings.

Acronis Cyber Infrastructure (ACI) instances built before build 6.0.1-112, before build 6.1.1-64, and before build 6.2.1-71 are affected.

The flaw carries a CVSS score of 3.3, categorizing it as low severity, and it is not listed in CISA's KEV catalog. EPSS data is not available, so the probability of exploitation in the wild is uncertain. The likely attack vector is any authenticated session that can reach the component with the authorization defect. An attacker requires valid user credentials but can subsequently access or alter sensitive data, thereby compromising confidentiality and potentially integrity of the infrastructure.