This weakness allows an attacker to bypass token validation, enabling the reading of sensitive data stored by the system. The likely attack vector is a remote attacker who can send crafted requests to the affected endpoints and gain access to confidential information. The flaw does not require elevated privileges within the system, so it can be exploited by anyone able to reach the application over the network.

Acronis Cyber Protect 17 on Linux and Windows platforms before build 42587 is vulnerable. Users running these builds should check the build number; any build earlier than 42587 is affected.

The CVSS score of 6.2 indicates moderate technical impact and exploitability. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting no current large‑scale exploitation data. Still, an attacker with network access to the affected service could read protected data, so remediation is recommended without delay.